3 ms·
Isn't CSRF basically dead after `SameSite=Lax` was made the default [1]? Also, magic links being valid upto certain time doesn't sound a serious vulnerability t
by shubhamjain 4y ago
Isn't CSRF basically dead after `SameSite=Lax` was made the default [1]? Also, magic links being valid upto certain time doesn't sound a serious vulnerability to me. If the hacker has access to person's email/browser, the game is already over. There could be valid reasons—UX-wise—for not making magic links invalidate on the first use. Ex, the user wants to login on phone with the same link. I am sorry, but the post sounds more like amateurs who love reporting things like this to companies, hoping one of them will fall for it and pay them a bounty.
[1]: https://scotthelme.co.uk/csrf-is-really-dead/ https://scotthelme.co.uk/csrf-is-really-dead/
- simonw 4y agoSameSite cookies don't protect against Login CSRF by default, since that attack can be triggered by a request that carries no cookies at all. I wrote a bit about that here: https://simonwillison.net/2021/Aug/3/samesite/#login-csrf-samesite-lax https://simonwillison.net/2021/Aug/3/samesite/#login-csrf-sa... Plus, SameSite cookies are only supported by 95% of worldwide browser traffic, according to https://caniuse.com/same-site-cookie-attribute https://caniuse.com/same-site-cookie-attribute If you're a vendor selling SSO services I'm going to expect you to have 100% coverage on CSRF mitigations like this!
- shubhamjain 4y agoThese attacks, although theoretically possible, require a lot of assumptions. We want the user to be using an archaic browser, visitor to be user of the site we want to exploit, and visiting a the site we have exploit on.The problem is that if the company dedicated resources to fixing such small issues, which are almost guaranteed to not being exploited, the company is ignoring more important ones which have much wider surface, like an exposed internal tool.