Collaborate Disseminate
I have read an article about CSRF bypasses when a cookie set with Samesite: Strict.
Normally if a cookie is set with Samesite: Strict then it will not be sent in a cross origin request. But if the application e.g.: vulnerablesite.com is vu… Continue reading Questions regarding CSRF using Client Side redirect
I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has been resolved by Chrome, which means tha… Continue reading Lax SameSite and POST (2 minute)
I am trying to implement measures against csrf in my client spa.
I have the following question, since it is difficult for me to use the Signed Double-Submit Cookie.
It is possible to implement a csrf preventive measure, where the client ge… Continue reading javascript app preventing csrf
I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it
The idea i have is I have two domain att.com and victim.com. The login functionality on victim.com creates the session and als… Continue reading Double Submit Cookie Bypass
Will a random-generated-session-key be enough, so that I can end the usage of csrf token? The front end, will receive the token when logged in. It will be stored in «local storage» at the client’s device and check for every request to back… Continue reading No csrf token, instead sessiontokens?
How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible?
for example, to be clearer, I have my session authenticated i… Continue reading HTTPonly token without CSRF is safe?
I’m reading an article on Okta’s engineering blog, which contains the following paragraph:
Some of the disadvantages of cookies include:
Cross-site request forgery attacks (XSRF or CSRF): CSRF attacks are only possible with cookie-based s… Continue reading Why wouldn’t a site’s cookies be sent in this scenario?
Introduction
Multi-tenant vs single-tenant software architectures
Software multitenancy is a software architecture in which a single instance of software runs on a server and serves multiple tenants. Systems designed in such manner are &q… Continue reading Calculating CVSS scores for vulnerabilities in multi-tenant applications
I’m exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header around through Javascript code.
The idea … Continue reading OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header
I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for authentication. My understanding is that… Continue reading Necessity of CSRF Protection with ID Token Authentication in Firebase