Cross site request forgery
Main idea
Sensitive request should have some degree of unpredictability in order to prevent an attacker tricking a victim to issue or reissue such a request. The attacker has only to direct victims to his site where they will issue a request to the targeted website.
Typical situations
- Validation of CSRF token depends on request method
- Validation of CSRF token depends on token being present
- CSRF token is not tied to the user session
- CSRF token is tied to a non-session cookie
- CSRF token is simply duplicated in a cookie
- Validation of Referer depends on header being present
- Validation of Referer can be circumvented
Resources
