Thread by @CookiesNotFound

Preventing Cross-Site Request Forgery(CSRF) attacks - auth0.com/blog/cross-sit…

#security #websecurity #sec #infosec

what is Cross-Site Request Forgery?

it is a type of attack performed on web apps in order to carry out a malicious action without user's explicit consent.
these 'malicious actions' could be anything. for example: changing email address, personal information etc

#websecurity

how it is performed?

* attacker leads the user to perform an action(through email, website etc)

* attacker makes a request on behalf of the user(by using a hidden form, for example)

* vulnerable website sees it as a genuine action(by verifying session cookie)

#CodeNewbie

do CSRF attacks work on token-based auth?

No. token-based auth mechanisms are not vulnerable to as they are stored in either sessionStorage or localStorage.
however, token-based auth systems could be vulnerable to Cross-Site Scripting(XSS) attacks.

#XSS #infosec #webdev

why vulnerable site treats CSRF requests as genuine actions?

that's because authentication is done through session and cookie(session-based auth mechanism). so, when the browser makes a request to the vulnerable (...cntd.)

.... web server(whether from the attacker's website or iframe, it does not matter), it sends the cookie as well. this makes the vulnerable server to think it as a genuine request.

attack performed!

#CodeNewbie #JavaScript #HTML5 #code

preventing CSRF attacks

* use CSRF token in forms
* double submit cookie strategy
* sameSite cookie (in server, `cookie.sameSite = 'strict'`)
* verifying legitimacy of the client (Origin and Referer headers)

#CodeNewbie #programming #code #webdev #Developer #javascript

resources:

1. auth0.com/blog/cross-sit…
2. stackoverflow.com/questions/3769…
3. owasp.org/www-community/…
5. packetlabs.net/cross-site-req…
6. i.ibb.co/3vNj7Tw/csrf-a… (infographic)