4 ms·
For a minute, I thought these were direct links to delete your account, meaning that going to these links would delete your account immediately, a bit like like
by vortico 7y ago
For a minute, I thought these were direct links to delete your account, meaning that going to these links would delete your account immediately, a bit like like Super Logout (DO NOT CLICK https://superlogout.com/ https://superlogout.com/ OPEN IN INCOGNITO TAB).
- yoz-y 7y agoWhich raises a question of how many services out there do have links that would delete your account without confirmation (or confirmation that could be somehow spoofed by client side JS).
- t0astbread 7y agoHow could you even implement an easy account deletion flow with un-spoofable confirmation if the whole client is considered untrusted?
- vortico 7y agoI think checking referrers is the normal way to solve this. As long as your site doesn't have XSS vulnerabilities on other pages, I think you're fine, but I'm not an expert though. EDIT: Nonces are better, ignore this reply.
- iwalton3 7y agoUsually this is done by sending an nonce that must be sent back with the request to delete the account. The attacking site won't have the nonce, so it cannot delete the account. Currently, you can also get a similar protection by requiring headers such as "Content-Type: application/json", since other sites will not be able to make that request. Referer does work in some cases, but it is fairly common for users to disable the Referer, so relying on it for site functionality is not ideal.
- t0astbread 7y agoHow's the resource containing the nonce any more secure than just a plain "delete-account" endpoint? Thinking about it, you could probably use CORS and some methods like X-Frame-Options to protect your nonce. But then you could just use that on the whole deletion page and avoid the nonce, I guess?
- vortico 7y agoThe nonce would only be available if you scrape the page while logged in and extract the logout URL, which is impossible with iframes.
- t0astbread 7y agoCould you not still scrape the HTTP response for the page containing the nonce?
- vortico 7y agoNot with a browser, no.
- yjftsjthsd-h 7y agoI'm surprised that isn't blocked by cross-site scripting prevention or something along those lines. Shouldn't forcing logout require that you have the cookie that proves that you're logged in in the first place?
- vortico 7y agoAny site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.
- yjftsjthsd-h 7y agoIt really shouldn't be GET anyways; that's asking for trouble.
- iwalton3 7y agoSome of the pages that are exploited do use POST though. If it accepts authorization through a cookie and doesn't require an XSRF token or JSON content type, it is probably vulnerable. But yes in general making actions happen in response to a GET request is generally a bad idea, since these are often cached and considered "safe" to retry.
- _jomo 7y agoPlease don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons. Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.
- throwaway63839 7y agoNot true. Using samesite cookie attribute prevents CSRF through IMG tags. (On browsers that support samesite, i.e. most browsers.)
- hirsin 7y agoThis is tricky - it's up to the site basically. For single site websites (hacker news, let's say) then yeah - samesite should be enabled to prevent this. For a large IDP like Google, Facebook, Microsoft, etc, you start to want* logout via cross-site requests, but it needs to be protected against DoS attacks like the link provided. So you need some other proof that the requesting site has a session - a session ID, an ID token, a unique identifier for one of the users in session (this is the least bulletproof one). * well, standards wise at least. Google doesn't document a logout url anymore.
- dmix 7y agoWhy would they make it on initial load and not have a confirmation step + a list of supported sites first? Is it for trolling?