90 ms·
Fortunately, the attack is limited by the fact that the attacker can't see the response from the server. If the attacker could view the response, it would break
by nbpoole 16y ago
Fortunately, the attack is limited by the fact that the attacker can't see the response from the server. If the attacker could view the response, it would break CSRF protection based on nonces as well.
- bensummers 16y agoWhat if that forged request was to a "create new account" URL, for example? Or to delete something important? Or transfer some money? Do you need to see the response to do bad things?
- dminor 16y agoI think what he's saying is if your CSRF protection is based on a nonce, this vulnerability doesn't break it.
- nbpoole 16y agoNo, but that wasn't my point. My point was that this vulnerability can be (and has been) worked around by using nonces in the header. If you can see the response body, that protection becomes worthless as well (and there is no workaround for that).