CSRF vulnerabilities
Making the victim's browser send a request she did not intend: the conditions, the defences (anti-CSRF token, SameSite, origin check) and why a GET must change nothing.
- 25 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
A few cards from the deck
CSRF: what is it?
Show the answer
An attack that pushes a logged-in victim's browser to send, to a trusted site, a request the attacker has crafted.
The site receives a request that looks authentic, with the victim's session: it cannot guess that it comes from a booby-trapped page. The attacker does not need to see the response.
Why does the session cookie not protect against CSRF?
- The browser attaches it by itself, whatever the site the request starts from
- It always travels in clear, so the attacker reads it on the network and copies it into his request
- It is too short to resist a brute-force attack launched from another site
- It expires as soon as the victim opens a second tab
Show the answer
The browser attaches it by itself, whatever the site the request starts from
The cookie proves the request comes from the victim's browser, not that she meant to send it. The attacker does not know the cookie and does not need it: the browser adds it for him.
A CSRF attack needs two conditions: a session carried by a … that the browser attaches by itself, and a request whose parameters are all … to the attacker.
Show the answer
A CSRF attack needs two conditions: a session carried by a cookie that the browser attaches by itself, and a request whose parameters are all predictable to the attacker.
A secret token in the request breaks the second condition: the attacker can no longer craft it whole.
Anti-CSRF token: what is it?
Show the answer
A random value tied to the session, placed in each form and required by the server when the request arrives.
A third-party site cannot read the bank's page (same-origin rule): it therefore does not know the token, and its forged request is rejected.