InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding CSRF attacks, how they exploit authenticated sessions, prevention with tokens and SameSite cookies, and implementing anti-CSRF protection.
What is CSRF?
Cross-Site Request Forgery forces authenticated users to execute unwanted actions on a web application. Since browsers automatically include cookies with requests, an attacker can craft a malicious page that triggers actions on a site where the victim is already authenticated.
CSRF Attack Flow
===================
1. Victim logs into bank.com (session cookie set)
2. Victim visits evil.com (while still logged in to bank.com)
3. evil.com contains: <img src="https://bank.com/transfer?to=attacker&amount=10000">
4. Browser sends request to bank.com WITH victim's session cookie
5. bank.com processes transfer (valid session, valid request format)
6. Attacker receives $10,000
The attack works because
- Browser automatically attaches cookies to requests
- Server can't distinguish legitimate vs forged requests
- No user interaction needed beyond visiting the malicious page
CSRF Attack Examples
Example
<!-- Simple GET-based CSRF -->
<img src="https://bank.com/transfer?to=attacker&amount=5000" width="0" height="0">
<!-- POST-based CSRF with auto-submit form -->
<form action="https://bank.com/transfer" method="POST" id="csrfForm">
<input type="hidden" name="to" value="attacker_account">
<input type="hidden" name="amount" value="10000">
</form>
<script>document.getElementById('csrfForm').submit();</script>
<!-- JSON-based CSRF -->
<form action="https://api.bank.com/transfer" method="POST" enctype="text/plain">
<input name='{"to":"attacker","amount":10000,"ignore":"' value='"}'>
</form>
Prevention Techniques
1. CSRF Tokens (Synchronizer Token Pattern)
Example
import secrets
from flask import Flask, session, request, abort
app = Flask(__name__)
app.secret_key = secrets.token_hex(32)
def generate_csrf_token():
"""Generate and store CSRF token in session."""
if '_csrf_token' not in session:
session['_csrf_token'] = secrets.token_hex(32)
return session['_csrf_token']
def validate_csrf_token():
"""Validate CSRF token on state-changing requests."""
token = request.form.get('_csrf_token') or request.headers.get('X-CSRF-Token')
if not token or token != session.get('_csrf_token'):
abort(403, "CSRF token validation failed")
@app.before_request
def csrf_protect():
if request.method in ['POST', 'PUT', 'DELETE', 'PATCH']:
validate_csrf_token()
# In templates:
# <form method="POST">
# <input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
# ...
# </form>
2. SameSite Cookie Attribute
python example
# Set SameSite attribute on session cookies
app.config.update(
SESSION_COOKIE_SAMESITE='Lax', # Default in modern browsers
SESSION_COOKIE_SECURE=True, # HTTPS only
SESSION_COOKIE_HTTPONLY=True, # No JavaScript access
)
# SameSite values:
# Strict: Cookie never sent cross-site (breaks OAuth flows)
# Lax: Sent with top-level navigations (GET only), blocks POST/img/iframe
# None: Always sent (requires Secure flag, used for cross-site APIs)3. Double Submit Cookie
python example
import hashlib
import hmac
def double_submit_csrf():
"""CSRF protection without server-side state."""
# Set CSRF cookie (readable by JavaScript)
csrf_cookie = secrets.token_hex(32)
response.set_cookie('csrf_token', csrf_cookie,
samesite='Lax', secure=True)
# JavaScript reads cookie and sends as header
# fetch('/api/transfer', {
# headers: {'X-CSRF-Token': getCookie('csrf_token')},
# ...
# })
# Server verifies cookie value matches header value
cookie_token = request.cookies.get('csrf_token')
header_token = request.headers.get('X-CSRF-Token')
if not cookie_token or not hmac.compare_digest(cookie_token, header_token):
abort(403)CSRF vs XSS Comparison
| Feature | CSRF | XSS |
|---|---|---|
| Attack target | Server-side actions | Client-side data/DOM |
| Requires authentication | Yes (exploits existing session) | No |
| Attacker can read response | No (blind attack) | Yes (full access) |
| User interaction | Minimal (visit malicious page) | Varies |
| Prevention | Tokens, SameSite cookies | Output encoding, CSP |
| Can bypass CSRF tokens | No (if implemented correctly) | Yes (XSS can read tokens!) |
Important: XSS can defeat CSRF protection because XSS can read the CSRF token from the page. Fix XSS first!
Interview Questions
- Why does CSRF work even when the victim didn't intend to make the request?
- Browsers automatically attach cookies (including session cookies) to any request to the cookie's domain, regardless of which site initiated the request. The server sees a valid session and processes the action as if the user intended it.
- How does the SameSite cookie attribute prevent CSRF?
- SameSite=Lax prevents cookies from being sent with cross-site POST requests (and sub-resource requests like img/iframe). Since CSRF relies on the browser sending the session cookie with the forged request, blocking cross-site cookie attachment defeats the attack.
- Can CSRF attacks steal data from the target site?
- Standard CSRF cannot read responses (Same-Origin Policy prevents it). It can only trigger actions (transfers, password changes, etc.). However, if combined with misconfigured CORS, an attacker might read responses. Login CSRF is an exception where the attacker logs the victim into the attacker's account.
- Why are GET requests less vulnerable to CSRF than POST?
- GET requests should be idempotent (no side effects) per HTTP spec. If a GET request changes state (like
/transfer?to=X), it's vulnerable via img tags and links. POST requests require form submission, which is slightly harder but still exploitable with auto-submitting forms.
- Explain how the Synchronizer Token Pattern prevents CSRF.
- The server generates a unique random token per session/request and embeds it in forms. On submission, the server verifies the token matches. An attacker cannot include the correct token because: (1) they can't read the victim's page (SOP), and (2) the token is unpredictable (cryptographically random).
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Cross-Site Request Forgery (CSRF).
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, web, csrf, attacks, cross-site request forgery (csrf)
Related Information Security Topics
Continue learning this concept
Web SecurityWeb Authentication MechanismsComprehensive guide to web authentication including sessions, JWT, OAuth 2.0, and passwordless authentication methods.Web SecurityCross-Site Scripting (XSS)Complete guide to XSS vulnerabilities including reflected, stored, and DOM-based XSS attacks with prevention techniques, CSP headers, and practical exploitation examples.Web SecurityFile Upload SecuritySecuring file upload features against malicious uploads including shell injection, path traversal, MIME type attacks, and implementing proper server-side validation.Web SecurityHTTPS and SSL/TLSDeep dive into HTTPS, SSL/TLS protocol handshake, certificate verification, cipher suites, and secure transport layer communication.Web SecuritySecure Coding Practices — Information SecurityEssential secure coding practices for web developers covering input validation, output encoding, error handling, and OWASP guidelines for building resilient applications.Web SecuritySession Management SecurityBest practices for secure session management including token generation, cookie attributes, fixation prevention, and timeout strategies.