3 ms·
Solely cookie based CSRF is the only way to do logged-out csrf. Once you are logged-in, you want to do session based to prevent a MITM-over-http from doing a CS
by amenghra 12y ago
Solely cookie based CSRF is the only way to do logged-out csrf. Once you are logged-in, you want to do session based to prevent a MITM-over-http from doing a CSRF on the https connection.
HSTS partially prevents the MITM-over-http, but not 100% the person doing the MITM potentially controls the clock (NTP is unauthenticated). Unless you do HSTS by whitelisting the domain in the browser.
Security is hard :(
- ZoFreX 12y agoLogged-out users could have sessions too, potentially. (Although logged out users don't need CSRF protection on many websites)
- amenghra 12y agoLogged-out csrf is an issue if you are serving as an oauth provider. There might be other use cases that I haven't thought about. I would ere on the side of precaution and implement logged-out csrf. If you create a session for the logged-out user, you must be careful about not recycling the same session once logged in or you expose yourself to session fixation. http://stephensclafani.com/2011/04/06/oauth-2-0-csrf-vulnerability/ http://stephensclafani.com/2011/04/06/oauth-2-0-csrf-vulnera... and http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulnerabilities-in.html http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulne... explain the issue pretty well.