10

When preventing CSRF attacks I should take the following steps:

  1. User logs in, set session cookie and generate CSRF token
  2. User submits form (with token) and it should match the token in session

But when an attacker uses an iframe it’ll also send the session cookie which results in the same CSRF token, also forms within the iframe will contain the token. So the attacker gets access.

What am I missing here?

1

1 Answer 1

10

You're missing the fact that IFrames do not get full access to Window objects under the Same Origin Policy unless their origins match. Details here:

JavaScript APIs such as iframe.contentWindow, window.parent, window.open and window.opener allow documents to directly reference each other. When the two documents do not have the same origin, these references provide very limited access to Window and Location objects

Therefore the attacker's frame will not be able to read window.document nor the CSRF fields within any contained form.

You do have Clickjacking to worry about, however. This is where your site is loaded in an IFrame but is then made transparent, and the user is enticed into clicking something on the attacker's page (e.g. "Win an iPad click here") which in fact causes the click to actually happen on a sensitive function within your page.

Uses of the X-Frame-Options: DENY and Content Security Policy frame-ancestors directives are recommended to prevent framing of your site.

2
  • 1
    But how would Clickjacking be useful if the form being attacked within the iFrame is empty and the attacker have no access to it to fill it using JavaScript?
    – Sisyphus
    Jan 25, 2020 at 17:45
  • There are two main scenarios here. 1) If the form only consists of buttons. 2) Any form present can be prefilled using query string or form values supplied by a POST. There might not be any CSRF checking at this stage as filling the form isn't considered a state changing action. Jan 26, 2020 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.