4 ms·
Your mitigation is wrong. You need a one way function around the cookie, otherwise that can be forged too.
by alexchamberlain 13y ago
Your mitigation is wrong. You need a one way function around the cookie, otherwise that can be forged too.
- tptacek 13y agoIf a blind attacker can't predict the token, and the token is reliably checked on form submission, it mitigates CSRF.
- homakov 13y agofurther more: this is one and the only proper protection. Referer: not reliable, proxies omit it Origin: not supported yet Additional header: could be tricked with Flash vuln