Isn't this XSSI, not CSRF?
JSON users: Avoid CSRFs by not using top-level arrays
21–30 of 85 posts
Re: JSON users: Avoid CSRFs by not using top-level arrays
#22Generally speaking, all incoming requests should be verified - authorized or not. These days with all kinds of wonderful web frameworks, CSRF protection is pretty simple. Django handles CSRF with a token in a hidden form field: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/
Having a CSRF token on your forms does not prevent, and has nothing to do with, with the attack in the article.
Hi, why not? If the attacker can't get any information without sending a token with the request, what's there to worry about? I'm not very good with js so I might have misunderstood something. Thanks!
Re: JSON users: Avoid CSRFs by not using top-level arrays
#23I'm not familiar with CSRF so had to look this up: [Cross Site Request Forgery] vulnerabilities occur when a website allows an authenticated user to perform a sensitive action but does not verify that the user herself is invoking that action. The key to understanding CSRF attacks is to recognize that websites typically don't verify that a request came from an authorized user. Instead they verify only that the request…
I hope you're not a web programmer. I'm not a web programmer and I knew that.
Re: JSON users: Avoid CSRFs by not using top-level arrays
#24This attack was used successfully against gmail in Jan 2006.
http://jeremiahgrossman.blogspot.com/2006/01/advanced-web-at...
Re: JSON users: Avoid CSRFs by not using top-level arrays
#25Array() doesn't seem to be called when defining an array with [] in Chrome 12 and Firefox 3.6+
Re: JSON users: Avoid CSRFs by not using top-level arrays
#26Earlier quoted context omitted.
Sometimes the laziest solutions are the most elegant.
Tangential: One of my favorite pieces about simplicity, laziness, dogmatism and getting things done is from Mark Jason Dominus[1]. His context isn't connected to this at all (it's about when and whether to use shell commands inside Perl scripts), but the larger point is very relevant: taking "Do the simplest thing that could possibly work" seriously can have surprising outcomes. tl;dr Sometimes ugly is elegant, too.…
Interesting article, and I had a similar issue with #perl recently as well.
They started with trying to fix a performance problem I didn't have, and then after my refusal to give them more information to fix a problem I didn't have, started insulting me.
Re: JSON users: Avoid CSRFs by not using top-level arrays
#27Generally speaking, all incoming requests should be verified - authorized or not. These days with all kinds of wonderful web frameworks, CSRF protection is pretty simple. Django handles CSRF with a token in a hidden form field: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/
Wouldn't Oauth solve this, since all requests are signed?
Re: JSON users: Avoid CSRFs by not using top-level arrays
#28Does anyone know how to rectify this if you're using the Rails 3 respond_with pattern?
Re: JSON users: Avoid CSRFs by not using top-level arrays
#29Earlier quoted context omitted.
This will stop embedding it in but why couldn't the attacking website do the same with eval and substring?
Because you cannot issue cross-domain AJAX calls, the attacker does not have access to the response body as a string that can be manipulated. https://secure.wikimedia.org/wikipedia/en/wiki/Same_origin_p...
Oh duh, I'm dumb.
Re: JSON users: Avoid CSRFs by not using top-level arrays
#30I'm not familiar with CSRF so had to look this up: [Cross Site Request Forgery] vulnerabilities occur when a website allows an authenticated user to perform a sensitive action but does not verify that the user herself is invoking that action. The key to understanding CSRF attacks is to recognize that websites typically don't verify that a request came from an authorized user. Instead they verify only that the request…
I hope you're not a web programmer. I'm not a web programmer and I knew that.
And the award for most pompous, unnecessary, and conceited response goes to... cheez!