From 54b11920de4e6b61217290c68f31db5a7240a0fd Mon Sep 17 00:00:00 2001 From: Thom Carter Date: Sun, 8 May 2022 22:49:11 +0100 Subject: [PATCH] Update CSRF post --- ...03-crsf-the-same-origin-policy-and-cors.md | 42 +++++++++---------- 1 file changed, 19 insertions(+), 23 deletions(-) diff --git a/_posts/2020-01-03-crsf-the-same-origin-policy-and-cors.md b/_posts/2020-01-03-crsf-the-same-origin-policy-and-cors.md index 08578d5..0cb63ed 100644 --- a/_posts/2020-01-03-crsf-the-same-origin-policy-and-cors.md +++ b/_posts/2020-01-03-crsf-the-same-origin-policy-and-cors.md @@ -6,39 +6,35 @@ date: 2020-01-03 ## CSRF -Using Cross Site Request Forgery (CSRF), an attacker can trick a user into making requests to a web service with which they have previously authenticated. This allows the attacker to perform destructive operations or extract data from the target service. +When a user is authenticated with a web service, an attacker can use cross-site request forgery (CSRF) to trick them into making a request to that service to perform a desired action. -Assume a user has previously authenticated with Facebook. An attacker could trick this user into making requests to Facebook by clicking a link or executing some malicious client-side code, either on the attacker's own site or injected into another page. A classic example is embedding an image tag on a page visited by the user, with the tag linking to a protected resource on the target service. The browser will automatically attempt to resolve the link in the tag when loading the page, thereby performing the request without the user's consent. +If a service uses `GET` requests for state-changing operations, the attacker could present the user with a link that triggers an unwanted update. `POST` requests can be triggered with a form submission. Both can be generated without deliberate action from the user, for example by embedding an image tag that links to a protected resource on the target service, or by including some JavaScript that submits a form on a mouseover event. An attacker could include malicious links or code on their own site, or embed either elsewhere, particularly where there is a cross-site scripting vulnerability. -## The same-origin policy - -The origin of a web page is generally the scheme, host and port taken together. Requests to a different origin than that of the requesting page are known as cross-origin requests. - -When a browser makes a cross-origin request as part of an AJAX call, it will raise an error and will not share the response with the calling code. This is the same-origin policy, which is intended to isolate content from different sources within the browser. +### Countermeasures -The policy prevents AJAX requests from being used to perform a CSRF attack that reads a user's data from a third party service. It prevents an attacker, for example, from serving a malicious script that could make `GET` requests to a service on a user's behalf and forward the responses. +HTTP methods should be used as intended. Specifically, use `POST` not `GET` for state-changing operations. Assuming that this is the case, `GET` requests can be considered safe: even if a request is unintended, its response is just returned harmlessly to the user's browser. -'Simple' cross-origin requests (`GET`, `HEAD` and `POST`, with certain content types) are attempted without preceding checks. Other requests (e.g. `POST` with JSON or XML content, `PUT`, `DELETE`) are subject to a preflight `OPTIONS` request to determine whether or not the request is safe to send. This is mostly to protect older servers that might not be aware that browsers are now able to perform these cross-origin requests. Note that it is still necessary to take measures to protect against CSRF attacks (via AJAX or not) made using cross-origin `POST` requests, which have always been possible. +`POST` requests can be protected by including a security token, verified by the server, in forms and AJAX requests, [as happens in Ruby on Rails][1]. -## CORS +`GET` requests for dynamic JavaScript resources can be vulnerable, as an attacker could include such a script in a `