CSRF: Cross-Site Request Forgeries
coffeeonthekeyboard.com
CSRF: Cross-Site Request Forgeries
1–10 of 22 posts
Re: CSRF: Cross-Site Request Forgeries
#2Google also did a very good job introducing security vulnerabilities, and also a sandbox for trying them out. Their take at Cross-Site Request Forgery: http://google-gruyere.appspot.com/part3#3__cross_site_reques...
The sandbox: http://google-gruyere.appspot.com/start
Re: CSRF: Cross-Site Request Forgeries
#3Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable
edit: maybe not grey but some colour which doesn't contrast with brown at all
Re: CSRF: Cross-Site Request Forgeries
#4* These are submitted with a form (over POST, hopefully) *
I don't think that the author implies that using POST prevents CSRFs but the article seems to imply it. In case anyone thinks it is the case: using POST won't prevent a CSRF.
Cross Site Request Forgeries occur when a user opens an "evil" page on site B, while being logged on site A. If site A solely relies on cookies in order to identify logged users, there is a risk of CSRF. The attack exploits the fact that the user's browser will always send the auth cookies when issuing a request to siteA. If the evil page on siteB embeds an image (or script, or any resource that can be loaded using an URL) whose source is an URL on siteA, the browser will request the resource on siteA with the auth cookie coming along.
In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.
Re: CSRF: Cross-Site Request Forgeries
#5Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable edit: maybe not grey but some colour which doesn't contrast with brown at all
It's brown on white as long as all the images load.
Re: CSRF: Cross-Site Request Forgeries
#6Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable edit: maybe not grey but some colour which doesn't contrast with brown at all
It's brown on white as long as all the images load.
Ah there we go, I didn't think to refresh :/
One of those days
Re: CSRF: Cross-Site Request Forgeries
#7* These are submitted with a form (over POST, hopefully) * I don't think that the author implies that using POST prevents CSRFs but the article seems to imply it. In case anyone thinks it is the case: using POST won't prevent a CSRF. Cross Site Request Forgeries occur when a user opens an "evil" page on site B, while being logged on site A. If site A solely relies on cookies in order to identify logged users, there i…
> In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.
Yes, but requiring POST for anything that changes anything (especially bank transfers) is a best practice anyway, for how all actors involved understand HTTP verbs, and reduces the surface area of attack.
You can create a POST with an iframe, but you can create a GET with an image tag: ``" rel="nofollow">http://mybank.com/transfer?...>`
Re: CSRF: Cross-Site Request Forgeries
#8Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable edit: maybe not grey but some colour which doesn't contrast with brown at all
Ugh, I really need to create a lighter-weight theme. Sorry about that.
Re: CSRF: Cross-Site Request Forgeries
#9Perhaps I'm just nieve but if someone has access to the DOM via XSS; isn't CSRF nonces like Django uses pointless?
Re: CSRF: Cross-Site Request Forgeries
#10Perhaps I'm just nieve but if someone has access to the DOM via XSS; isn't CSRF nonces like Django uses pointless?
Hopefully you're taking steps to prevent both. But yes, closing the CSRF window and leaving the XSS door open would largely defeat the purpose of CSRF protections.