Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON users: Avoid CSRFs by not using top-level arrays

flask.pocoo.org

Post reply on HN
Print view View original

31–40 of 85 posts

Re: JSON users: Avoid CSRFs by not using top-level arrays

#31

Post by Johngibb »

mmmm wrote: post #22
ZoFreX wrote: post #20

Earlier quoted context omitted.

Having a CSRF token on your forms does not prevent, and has nothing to do with, with the attack in the article.

Hi, why not? If the attacker can't get any information without sending a token with the request, what's there to worry about? I'm not very good with js so I might have misunderstood something. Thanks!

I believe that he's right that just putting it in a hidden form field would be useless for this sort of attack. However, I believe rails and django actually include the CSRF token in headers for ALL ajax requests, not just form submits.

Re: JSON users: Avoid CSRFs by not using top-level arrays

#32

Post by locci »

kkaefer wrote: post #25

Array() doesn't seem to be called when defining an array with [] in Chrome 12 and Firefox 3.6+

Because [] is not syntactic sugar for new Array. The code the article wrote about doesn't work in any implementation that I know of. I think the ESv3 spec wasn't very clear: "Create a new array as if by the expression new Array()." But the implementations (always?) did the right thing, and the ESv5 spec is more clear: it adds "where Array is the standard built-in constructor with that name."

Re: JSON users: Avoid CSRFs by not using top-level arrays

#33

Post by z92 »

Here is the catch:

> So now what happens if a clever hacker is embedding this to his website and social engineers a victim to visiting his site. >

If that happens then CSRFs or JSON is not the highest priority thing to worry about. The hacker controls everything. And no matter what I do, he can find a by pass.

Re: JSON users: Avoid CSRFs by not using top-level arrays

#34

Post by gruseom »

locci wrote: post #32
kkaefer wrote: post #25

Array() doesn't seem to be called when defining an array with [] in Chrome 12 and Firefox 3.6+

Because [] is not syntactic sugar for new Array. The code the article wrote about doesn't work in any implementation that I know of. I think the ESv3 spec wasn't very clear: "Create a new array as if by the expression new Array()." But the implementations (always?) did the right thing, and the ESv5 spec is more clear: it adds "where Array is the standard built-in constructor with that name."

This comment and the GP suggest that the article is wrong. Is it? Can anyone confirm a JS implementation that manifests the described behavior (the Array constructor being called when parsing top-level [] in JSON)?

It obviously worked this way at some point (http://news.ycombinator.com/item?id=2668888), so I'm guessing the older IEs, at least, still have this flaw.

Re: JSON users: Avoid CSRFs by not using top-level arrays

#35

Post by ivank »

locci wrote: post #32
kkaefer wrote: post #25

Array() doesn't seem to be called when defining an array with [] in Chrome 12 and Firefox 3.6+

Because [] is not syntactic sugar for new Array. The code the article wrote about doesn't work in any implementation that I know of. I think the ESv3 spec wasn't very clear: "Create a new array as if by the expression new Array()." But the implementations (always?) did the right thing, and the ESv5 spec is more clear: it adds "where Array is the standard built-in constructor with that name."

The attack worked in an older Firefox, at least.

Re: JSON users: Avoid CSRFs by not using top-level arrays

#36

Post by mmaunder »

Does anyone know if it's possible to override constructors for the global "Object" in Javascript? The author's assumption is that it is not possible and therefore the best solution to this is to wrap all your JSON with {} instead of []. My intuition is telling me that's not the fix. Can someone verify?

It seems the best solution is not to use a top level object but (as mentioned below) Facebook's solution to prepend for(;;) to all JSON and strip it before parsing or Google's to prepend 'throw' and strip it pre-parsing.

Update: This conversation says it's not possible, but I'm still not a believer: http://sla.ckers.org/forum/read.php?2,35337,35337

Re: JSON users: Avoid CSRFs by not using top-level arrays

#37

Post by espeed »

adolph wrote: post #6

I'm not familiar with CSRF so had to look this up: [Cross Site Request Forgery] vulnerabilities occur when a website allows an authenticated user to perform a sensitive action but does not verify that the user herself is invoking that action. The key to understanding CSRF attacks is to recognize that websites typically don't verify that a request came from an authorized user. Instead they verify only that the request…

A few days ago I asked, "Ask HN: Best Approaches to Prevent Session Hijacking?" (http://news.ycombinator.com/item?id=2663293) and presented a technique I'm experimenting with that uses session timestamps as tokens to validate that each request is authentic and an attacker hasn't stolen the session key.

It works by updating the token (timestamp) on the server and in the cookie on each request and they both have to match on the next request. A short buffer (say 30 seconds) is permitted to avoid false positives from click-happy users on slow/flaky connections.

Has anyone used this technique in production?

Re: JSON users: Avoid CSRFs by not using top-level arrays

#39

Post by tedunangst »

personalcompute wrote: post #21

Isn't this XSSI, not CSRF?

Apache Extended Server Side Includes? Haven't seen XSSI before. What's the I?

I agree, this is not the attack I think of when somebody mentions CSRF. Well, the solution at least isn't. I would be very suspicious of anyone who claimed to solve their CSRF holes by not using arrays.

Re: JSON users: Avoid CSRFs by not using top-level arrays

#40

Post by [deleted] »

mmaunder wrote: post #36

Does anyone know if it's possible to override constructors for the global "Object" in Javascript? The author's assumption is that it is not possible and therefore the best solution to this is to wrap all your JSON with {} instead of []. My intuition is telling me that's not the fix. Can someone verify? It seems the best solution is not to use a top level object but (as mentioned below) Facebook's solution to prepend…

[deleted]
Post reply on HN