3 ms·
Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is
by badman_ting 13y ago
Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.
- dcaunt 13y agoYou're right, it's not an absolute fix. It would have prevented requests from an authenticated browser (without a mobile UA) from being accepted, reducing the effectiveness of the attack.
- meritt 13y agoFor a CSRF attack it actually does because it needs to be executed inside an unsuspecting victim's browser. That wouldn't be sending an custom Instagram user-agent.
- phr0nak 13y agoAs you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.