4 ms·
obviously second version (when CSRF token is stolen) is not possible to mitigate.
by homakov 13y ago
obviously second version (when CSRF token is stolen) is not possible to mitigate.
- btilly 13y agoThere is a way that the CSRF attack could be prevented. And that is if only every other byte of the CSRF token was part of the token, and the others were random every time. In that case it would be impossible to predict common text in the CSRF based on past compression rounds.
- homakov 13y agoXOR-based masking, yes, but I thought we were talking about currently common systems. Until BREACH nobody masked tokens, did they?
- btilly 13y agoNobody did, but that is how life goes. An attack is found. A defense is found. And you can't build a secure system without knowing all of the attacks and corresponding defenses.
- homakov 13y agoi wouldn't call it a proper defense, rather a work around. besides CSRF tokens there are lots of secret strings, and it's not website's problem to avoid wiretapping