Win a copy of Node.js Design Patterns: Design and implement production-grade Node.js applications using proven patterns and techniques this week in the Server-Side JavaScript and NodeJS forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Ron McLeod
  • Rob Spoor
  • Tim Cooke
  • Junilu Lacar
Sheriffs:
  • Henry Wong
  • Liutauras Vilda
  • Jeanne Boyarsky
Saloon Keepers:
  • Jesse Silverman
  • Tim Holloway
  • Stephan van Hulst
  • Tim Moores
  • Carey Brown
Bartenders:
  • Al Hobbs
  • Mikalai Zaikin
  • Piet Souris

Possible flaw on using tokens to fix CSRF (Cross Site request forgery)?

 
Greenhorn
Posts: 13
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Hello.

Based on what I have researched, using tokens is the best way to prevent CSRF attacks on web applications. This basically involves creating token parameters in every jsp page of the application.

Here's my issue:

What if this fix is already implemented in the application but this scenario happens? - user accidentally closes the browser or tab of the application where he is already logged in. In other to go back, he would need to enter again in the new browser or tab, the url of where he was working (if he can remember it) or enter again the home page of the application. Wouldn't that be the same as a CSRF attack? and thus, the application not processing the request and therefore, the user would not be able to continue. If user enters again, the url in the new browser or tab, there wouldn't be any token with it, therefore the application considering it as a CSRF attack?

How does one fix this kind of scenario if there is already an existing CSRF handling in the web application.



thanks,
 
author & internet detective
Posts: 40747
827
Eclipse IDE VI Editor Java
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Good question. It's not the same thing as a CSRF attack if the user re-opens a browser or even copy/pastes a URL with a token in it. A CSRF attack is when a hacker tries to execute a URL that does something without the user's consent. For example, when posting here, we use a CSRF token so nobody can post without your knowledge. If I sent you a secret link to your email and hid it in an image or even asked you to click on it saying it was something harmless, the token wouldn't match so you wouldn't be able to post. That's why a new session has to use a different token. It is more secure to have a new token per request, but that has usability issues.

By contrast, it is no big deal if you show up to a page to the post form with the wrong token. The page ignores it and creates the form with the right token. Then when submitting the form that actually does the post, you do have the right token. You only need to check CSRF tokens for pages that "do something" like update the database, put a message on a queue, etc. Read only pages are fine. What's the worst that can happen? The user wastes some bandwidth?
 
luuk citroen wty
Greenhorn
Posts: 13
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

It's not the same thing as a CSRF attack if the user re-opens a browser or even copy/pastes a URL with a token in it. A CSRF attack is when a hacker tries to execute a URL that does something without the user's consent.



But its impossible for the user to know the current token used right? he might not be even aware of it. When the scenario I describe happens, and the user tries to get back by entering the url again, he would surely enter it without the token. Therefore, an application with CSRF handling will consider this as a CSRF attack.

The only way to continue is if the user would wait for the session to expire and login again. Is this really a limitation for CSRF prevention?
 
I'm just a poor boy, I need no sympathy, because I'm easy come, easy go, little high, little low, little ad
Thread Boost feature
https://coderanch.com/t/674455/Thread-Boost-feature
reply
    Bookmark Topic Watch Topic
  • New Topic