4 ms·
Here's Google's reply to this particular "vulnerability": http://www.google.com/about/company/rewardprogram.html#logout-forgery http://www.google.com/about/comp
by brian_peiris 15y ago
Here's Google's reply to this particular "vulnerability": http://www.google.com/about/company/rewardprogram.html#logout-forgery http://www.google.com/about/company/rewardprogram.html#logou...
- simonw 15y agoI don't understand why Google say that this is an issue that can't be solved - why can't they use a CSRF token on their logout feature, either by switching to using a POST form or by appending a CSRF token to the query string?
- deleted 15y ago[deleted]
- wglb 15y agoIf you think of the damage that can be done by a logout CSRF, it is not going to harm very much. Really a low-level issue.
- simonw 15y agoI get that - but the Google security FAQ suggests that fixing the issue is essentially impossible, whereas I'm pretty sure fixing it is the same as fixing any other CSRF hole.
- nbpoole 15y agoThe point that those blog posts make is that it's possible for a malicious attacker to log people out of a third-party site in multiple ways (specifically by messing with the user's cookies). Protecting one of those ways provides little to no benefit if the others are still unprotected. One reason I've also heard cited is that you always want the logout links in your application to work: you want users to be able to terminate their sessions quickly and easily. If you have a CSRF token tied to your user's session and that user happens to click on an old logout link (maybe they had an old tab open or something), the user won't be logged out of the application.
- deleted 15y ago[deleted]
- mhansen 15y agoThat won't work without javascript, and then you need another URL to fallback to that'll respond to GET requests for non-javascript browsers. And then you could just XSRF the non-javascript URL. [Disclaimer: I work at Google, but not on any area related to this]
- simonw 15y agoI don't understand why this would need JavaScript - regular CSRF protection for POST requests works fine without JavaScript - why can't that be applied to the logout button?
- simonw 15y agoI don't understand why Google say that this is an issue that can't be solved - why can't they use a CSRF token on their logout feature, either by switching to using a POST form or by appending a CSRF token to the query string?