3 ms·
Logged-out users could have sessions too, potentially. (Although logged out users don't need CSRF protection on many websites)
by ZoFreX 11y ago
Logged-out users could have sessions too, potentially. (Although logged out users don't need CSRF protection on many websites)
- amenghra 11y agoLogged-out csrf is an issue if you are serving as an oauth provider. There might be other use cases that I haven't thought about. I would ere on the side of precaution and implement logged-out csrf. If you create a session for the logged-out user, you must be careful about not recycling the same session once logged in or you expose yourself to session fixation. http://stephensclafani.com/2011/04/06/oauth-2-0-csrf-vulnerability/ http://stephensclafani.com/2011/04/06/oauth-2-0-csrf-vulnera... and http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulnerabilities-in.html http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulne... explain the issue pretty well.