5 ms·
Are there credible situations where you would be able to do (2) but not able to simply read the cookie from the DOM and send it to an attacker controlled websi
by murbard2 14y ago
Are there credible situations where you would be able to do (2) but not able to simply read the cookie from the DOM and send it to an attacker controlled website?
- amalcon 14y agoAn attacker can build a hidden form that submits to a URL at the victim site, and submit it repeatedly using javascript. Alternatively an attacker could put the test content in the URL (we don't care if it 404s), which would work just as well and allow them to use a series of script-free pages full of images. edit: tptacek is absolutely right; there isn't a way to defend against this in application code. All you can do is turn off TLS compression. This is NOT by any means the only approach, it's just the most obvious one.
- tptacek 14y agoCareful: you're outlining the attack well, but you wouldn't want to give someone the impression that defending against CSRF also defends against attacks like BEAST.
- jgeralnik 14y agoYou can't read the cookie for the victim website from a malicious site. What you can do is send POST/GET requests to which the browser will attach the appropriate cookies.
- murbard2 14y agoOops, yes of course, now I feel stupid for asking. Thanks.