3 ms·
Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com https://yourdo
by jasonkeene 15y ago
Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).
- nbpoole 15y agoExcept an attacker can strip a referer header: if you fail open like that, you leave yourself open to attack. See http://blog.kotowicz.net/2011/10/stripping-referrer-for-fun-and-profit.html http://blog.kotowicz.net/2011/10/stripping-referrer-for-fun-... for examples
- jasonkeene 15y agoIn order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.