Skip to main content

New answers tagged

4 votes

Does the absence of CSRF tokens need to be fixed as soon as possible?

You should evaluate the situation as soon as possible in order to see if you are at risk: Do you expose mutations/actions as GET? (which is bad) Do you expose mutations/actions using text/plain, ...
ysdx's user avatar
  • 1,775
3 votes
Accepted

Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage?

I'm thinking of checking the device fingerprint and whether the IP address is in the trusted IPs list. Some applications bind the session to the user's IP address or user agent. However, this is ...
Sjoerd's user avatar
  • 31.8k

Top 50 recent answers are included