csrf

I'm building a webshop based on the slim3 framework. I need to handle a server-to-server POST-request to confirm if payment was successful. I added csrf to the container like this: $container['csrf'] = function($container) { return new \Slim\Csrf\Guard; }; and added it to the app like this: $app->add($container->csrf); And it works good. But now i need to be able to add an exception to a certain route so i get the post reques they are sending. I'couldn't find a working solution so far. Any advice? If you need to exclude one route from a middleware, there are two options: Option 1: group your

Ok, so I'm developing a web app that has begun to be more ajaxified. I then read a blog that talked about javascript hijacking , and I'm a little confused about when it's actually a problem. I want some clarification Question 1: Is this the problem/vulnerability? If my site returns json data with a 'GET' request that has sensitive information then that information can get into the wrong hands. I use ASP.NET MVC and the method that returns JSON requires you to explicitly allow json get requests. I'm guessing that they are trying to save the uninitiated from this security vulnerability. Question

Is it safe to use a signal auth-token in cookie for auth (post and requst only json via ajax)? Why attacker can not get the form token in hidden field? How an attacker do a CSRF attack with a POST request? Is it safe to use a single token in a cookie for authentication? Sort of, if that cookie is HTTP-only (which helps protect against XSS) and SSL then there's no way anyone outside your site can read that cookie. However, the user's browser can retain that cookie, and will automatically send it whenever their browser requests a page from your application again. This is desired when the user is

I have searched a lot trying to find something for my purpose, however most solutions revolve around CSRF tokens that work in conjunction with session data. My purpose requires "time based" token for cross server communication. I have Server A that needs to receive and validate a token that is sent to it via POST from Server B . The token needs to be generated on Server B by hashing with a secret key. Server A has to validate the same. Now, the problem is that token needs to be limited to single-use (possibly?) and should expire based on time (say 10 minutes lifetime). Since, this is cross

Flask之操作cookie app.py from flask import Flask, request, Response app = Flask(__name__) @app.route('/') def add_cookie(): # 返回操作面板 link = ''' <div> <h1>cookie 操作台</h1> <p><a href="/add_cookie">add cookie</a></p> <p><a href="/show_cookie">show cookie</a></p> <p><a href="/del_cookie">del cookie</a></p> </div> ''' return link @app.route('/add_cookie') def set_cookie(): res = Response("add cookies") res.set_cookie(key="name", value="maotai") # 添加cookie return res @app.route('/show_cookie') def show(): return request.cookies.__str__() # 获取cookie,并打印到前台 @app.route('/del_cookie') def del_cookie(): res

I've been playing with the new csrf functionality in Spring Security 3.2.0.RC1, and noticed that it doesn't seem to work with enctype="multipart/form-data" forms. I have a simple Spring form: <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %> ... <form:form action="${pageContext.request.contextPath}/model/create" modelAttribute="myForm" enctype="multipart/form-data"> and the hidden csrf input is being rendered as expected: <input type="hidden" value="..." name="_csrf"> but the request fails the csrf check (it works fine if I remove enctype="multipart/form-data"). The

　　 CSRF概念： 　　 CSRF跨站点请求伪造(Cross—Site Request Forgery) ，跟XSS攻击一样，存在巨大的危害性，你可以这样来理解： 攻击者盗用了你的身份，以你的名义发送恶意请求，对服务器来说这个请求是完全合法的，但是却完成了攻击者所期望的一个操作，比如以你的名义发送邮件、发消息，盗取你的账号，添加系统管理员，甚至于购买商品、虚拟货币转账等。 如下：其中Web A为存在CSRF漏洞的网站，Web B为攻击者构建的恶意网站，User C为Web A网站的合法用户。 　　 原理图： 　　 　　 　　关键点： 　　1．用户要访问正常网站 　　2．在没有关闭网站的情况下（或者session未失效），在打开网站B（危险网站） 　　3．危险网站并没有获取用户的cookies 　　测试方法： 　　搭建一个服务，做一个提交表单的页面，在提交的链接中写上A的某个提交页面，form里面构造提交数据（作为一个测试，这些内容很容易知道）。然后在访问A的情况下，点击构造的页面即可。 　　CSRF攻击实例： 受害者 A 在银行有一笔存款，通过对银行的网站发送请求 http://bank.example/withdraw?account=A&amount=1000000&for=A2 可以使 A 把 1000000 的存款转到 A2 的账号下。通常情况下，该请求发送到网站后

In ASP.NET MVC, the validation logic called by ValidateAntiForgeryTokenAttribute allows anonymous anti-forgery tokens, i.e. tokens without any user-specific information such as IIdentity.Name or ClaimUid. So, if claims are not used and HttpContext.User is not set after login (not uncommon), a malicious user of the system can stage a CSRF-attack against any other user, using the malicious user's own legitimately acquired anti-forgery tokens. This doesn't seem desirable. Why are anonymous tokens allowed? The anti-CSRF system in MVC allows anonymous users because it needs to protect the login