Lukas' Notes

Cross-Site Request Forgery

1 min read

web security

Definition

Cross-Site Request Forgery (CSRF)

CSRF forces an unwanted state-changing action on a server within a session the victim is already authenticated on. Because cookies are attached to cross-site requests by default, a forged form running on evil.com can trick the victim’s browser into POSTing to bank.com authenticated as the victim.

<!-- on evil.com, auto-submitted JS -->
<form action="https://bank.com/transfer" method="post">
  <input type="hidden" name="to"    value="hacker">
  <input type="hidden" name="sum"   value="1337">
</form>

On submission the browser attaches the victim’s session cookie, and the unwanted transfer goes through. The root issue is that cookies authenticate the request but the request does not authenticate the originator’s intent.

Defences

  • SameSite cookies — do not attach cookies to cross-site requests; mitigates CSRF cross-site but not CORF (a same-site variant) and adoption is uneven.
  • Double-submit pattern — mirror a CSRF token in both a cookie and a POST parameter, compare server-side.
  • Synchroniser token pattern — store the token in the signed session and echo it as a POST parameter; robust against same-site attempting because overwriting the session deauthenticates the victim.

Backlinks