In many web application frameworks, CSRF tokens are session scoped. So an attack might look like this: 1. User logs in to target web app (e.g. hapless.com).

In many web application frameworks, CSRF tokens are session scoped. So an attack might look like this: 1. User logs in to target web app (e.g. hapless.com). 2. User visits your malicious content (e.g. evil.com). 3. Your page does a BREACH attack, issuing tons of HTTPS GET requests (by creating images in JavaScript, maybe) to hapless.com with query string parameters that manipulate the response. 4. You observe the responses and recover the CSRF token. 5. You attack the user with a standard CSRF attack on evil.com or elsewhere. Note that this attack requires the user to interact with attacker-controlled content via a MITM'd connection. > I imagine tons of applications do this, but it's nowhere near as far reaching as CRIME. This is very common in web applications. Echoing query string parameters in the server response is the basis for reflected cross-site scripting, for example. And in a complex web application, tons of pages will have CSRF tokens embedded somewhere. I do agree that CRIME is a much more dangerous attack.