csrf | 易学教程

Single use CSRF token generation and validation for cross server communication in PHP

阅读更多关于 Single use CSRF token generation and validation for cross server communication in PHP

问题 I have searched a lot trying to find something for my purpose, however most solutions revolve around CSRF tokens that work in conjunction with session data. My purpose requires "time based" token for cross server communication. I have Server A that needs to receive and validate a token that is sent to it via POST from Server B . The token needs to be generated on Server B by hashing with a secret key. Server A has to validate the same. Now, the problem is that token needs to be limited to

Why is Rails giving me “Can't verify CSRF token authenticity” error?

阅读更多关于 Why is Rails giving me “Can't verify CSRF token authenticity” error?

I am getting a "Can't verify CSRF token authenticity" in Rails production. My questions are: Why is it doing this? How can I fix it? Here's my Heroku logs (some values anonymized): 2016-02-13T01:18:54.118956+00:00 heroku[router]: at=info method=POST path="/login" host=[MYURL] request_id=[ID STRING] fwd="FWDIP" dyno=web.1 connect=0ms service=6ms status=422 bytes=1783 2016-02-13T01:18:54.116581+00:00 app[web.1]: Started POST "/login" for [IPADDRESS] at 2016-02-13 01:18:54 +0000 2016-02-13T01:18:54.119372+00:00 app[web.1]: Completed 422 Unprocessable Entity in 1ms 2016-02-13T01:18:54.118587+00:00

Spring security 3.2.0 RC1 csrf with multipart/form-data

阅读更多关于 Spring security 3.2.0 RC1 csrf with multipart/form-data

问题 I've been playing with the new csrf functionality in Spring Security 3.2.0.RC1, and noticed that it doesn't seem to work with enctype="multipart/form-data" forms. I have a simple Spring form: <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %> ... <form:form action="${pageContext.request.contextPath}/model/create" modelAttribute="myForm" enctype="multipart/form-data"> and the hidden csrf input is being rendered as expected: <input type="hidden" value="..." name="_csrf">

Anti-CSRF cookie?

阅读更多关于 Anti-CSRF cookie?

问题 I'm building an application that uses a lot of ajax. Most anti-CSRF solutions revolve around putting some info in the viewstate and working with that data on post. However, I don't have access to the viewstate in an ajax call. I plan to generate a GUID to insert a token in the cookie and the session state, make the cookie expire when the user logs out, modify the cookie token and session state at each request, and use an httpmodule to do the work by comparing what in the session with what's

Why does ValidateAntiForgeryTokenAttribute allow anonymous tokens?

阅读更多关于 Why does ValidateAntiForgeryTokenAttribute allow anonymous tokens?

问题 In ASP.NET MVC, the validation logic called by ValidateAntiForgeryTokenAttribute allows anonymous anti-forgery tokens, i.e. tokens without any user-specific information such as IIdentity.Name or ClaimUid. So, if claims are not used and HttpContext.User is not set after login (not uncommon), a malicious user of the system can stage a CSRF-attack against any other user, using the malicious user's own legitimately acquired anti-forgery tokens. This doesn't seem desirable. Why are anonymous

In what case can CSRF-exempt be dangerous?

阅读更多关于 In what case can CSRF-exempt be dangerous?

This question is more a re-insurance than one directly about how to code. As an autodidact i did not have a lot of possibilities to ask professionals such things, so i try here. I have read the documents in the django-docs ( https://docs.djangoproject.com/en/1.3/ref/contrib/csrf/ ) and some info on that page: http://cwe.mitre.org/top25/#CWE-352 As far as i have understood, django delivers a token (some kind of pin-code) to a user. And to verify it really is him, he has to return it the next time he does a request. And some guys at Google found out that this is even possible with ajax-requests,

Running jasperserver behind nginx: Potential CSRF attack

阅读更多关于 Running jasperserver behind nginx: Potential CSRF attack

We are using nginx for https traffic offloading, proxying to a locally installed jasperserver (5.2) running on port 8080. internet ---(https/443)---> nginx ---(http/8080)---> tomcat/jasperserver When accessing the jasperserver directly on its port everything is fine. When accessing the service through nginx some functionalities are broken (e.g. editing a user in the jasperserver UI) and the jasperserver log has entries like this: CSRFGuard: potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, uri:%request_uri%, error:%exception_message%) After some

第三方登录绑定CSRF漏洞利用

阅读更多关于第三方登录绑定CSRF漏洞利用

作者：pmiaowu 文章：https://www.yuque.com/pmiaowu/web_security_1/sq87w6 这里需要使用到一个微博账号与两个某厂商账号条件： 1、微博账号：182**77 (攻击者) 2、某厂商账号A：33*493@qq.com (攻击者) 3、某厂商账号B：28*165@qq.com (无辜受害者) 利用方法：步骤1：攻击者-登录微博步骤2：攻击者-使用某厂商账号A 登录从上面看其实有很多绑定账号快捷登录的方法,但是微博绑定的用户肯定是比较少的所以我们用它步骤3：攻击者-点击绑定微博抓包绑定微博的url： https://www.a.test.com/users/auth/weibo/callback?state={"can_transfer"%3A"true"}&code=c593bc150745c37a4d5ec05332d406af 这个url中的code就是我的微博一次性token 步骤4：无辜受害者-使用某厂商账号B 登录将url发送给账号B 打开： https://www.a.test.com/users/auth/weibo/callback?state={"can_transfer"%3A"true"}&code=c593bc150745c37a4d5ec05332d406af 这时提示绑定成功了~~~ 嘿嘿嘿

CSRF verfication failed, but only with IE9

阅读更多关于 CSRF verfication failed, but only with IE9

问题 I have set up CSRF as described in the Django docs (using Django 1.3). It works with FF and Safari, but on IE9 I get <div id="summary"> <h1>Forbidden <span>(403)</span></h1> <p>CSRF verification failed. Request aborted.</p> </div> In the response headers of the Ajax request I find Set-Cookie csrftoken=8db3637951243ffb591e6b2d6998ed03; expires=Fri, 14-Sep-2012 08:01:52 GMT; Max-Age=31449600; Path=/ It works in IE9 when using it in a normal Form (i.e. no Ajax involved). I am using Django behind

Mixins in Tapestry5

阅读更多关于 Mixins in Tapestry5

I'm new to Tapestry5, but because of an internship I need to work with it. Currently I am trying to build a mixin to integrate a CSRF token ( explanation here ) to any form. Is it even possible to achieve this in a mixin? If yes, could I access functions that the mixin offers from the page? I am really not sure about how mixins really work and I'm having big difficulties on finding information about how to create one. Can somebody explain how to create a mixin and if what I'm trying to do is even possible? Thanks a lot! You might find that the HMAC message authentication introduced in tapestry