4 ms·

Why would you attach a CSRF token to a GET request? GET requests shouldn't do things, so they shouldn't need to be protected against CSRF. (I see this is menti

• timf 17y ago
  Putting session keys in a GET URL happens a lot (whether it "should" or not :-)). It's an authentication scheme for access to the URL: your GET may or may not actually have "side effects" regardless, that's orthogonal.
  • deleted 17y ago
    [deleted]
• IsaacSchlueter 17y ago
  Let's say that you have an application that one part of your company has developed for use in several other sites your company runs. This application sits in an iframe. You want to make sure that it's only being used on sites from the *.example.com domains. So, you set a cookie in the .example.com domain, and then, on the server side, you create a one-way hash of that cookie and a key phrase (a crumb), and put it on the url of the iframe. The key phrase doesn't have to be particularly secret, it's mostly for convenience so that you can use the same cookie and hash function in multiple different applications without getting the same crumb everywhere for a given user. So, if a crumb is leaked, it's only going to expose one thing, not everything. Also, if you make it time-dependent, then it further limits the exposure. The iframe validates that the crumb in the query string matches the one-way hash that it gets by performing the same one-way hash against the cookies and the key phrase. Yahoo uses this technique all over the place. It's very effective as long as the crumb function is sufficiently clever. However, if your crumb is brute-forcible, then it can be exploited easily.