Questions tagged [csrf]
Cross Site Request Forgery is a malicious attack to exploit a website's trust in a user's browser.
4,644
questions
0
votes
0
answers
32
views
Problems with CSRF token in Django REST Framework integration with React
I'm doing a website using Django REST Framework as a backend with session authentication, React in the frontend and django-cors-headers to communicate between the two. Each is served in the same IP ...
0
votes
0
answers
12
views
How to test with MockMVC and CSRF in Spring Boot 3
I have a SpringBoot MockMVC Test where I want to test a post endpoint like this:
@AutoConfigureTestEntityManager
@SpringBootTest
@AutoConfigureMockMvc
class MyControllerTest {
@Autowired
...
0
votes
0
answers
7
views
CSRF-TOKEN Issues while parsing the GET Request
While parsing the GET Request HTTP call I received a 400 Bad Request Error and if I checked the request data, I could see some errors under the cookie header CSRF-TOKEN.
(https://i.stack.imgur.com/...
0
votes
0
answers
32
views
Develop Angular SPA on localhost and query the remote staging API
I have troubles setting up my development environment.
I am attempting to develop an Angular SPA which should, in the end, communicate with a Laravel backend that is hosted under the same top domain ...
0
votes
0
answers
18
views
SpringBoot - How I can configure samesite none Csrf Cookie
What I have:
I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it.
I only grant access by cors to my angular domain app.
What I need:
I need ...
0
votes
2
answers
85
views
Laravel @csrf empty value
The result generated by @csrf in Blade
<input type="hidden" name="_token" value="">
Also tried {!! csrf_field() !!} and {{ csrf_field() }} but still there is no ...
0
votes
0
answers
11
views
How do Samesite cookies work when frontend and backend are on different domains?
I'm new to backend development and I'm trying to learn about preventing CSRF attacks. I read that Samesite cookies can help, but I struggle to see how in certain situations.
Let's say I have a website ...
0
votes
0
answers
10
views
Is CSRF attack possible for API authenticating with cookie but not using forms?
I understand the mechanism of the CSRF attack with the form post, but I do not get how it is possible to send a post request from a malicious site.
Imagine I have SPA at origin S, Web API at origin A, ...
0
votes
1
answer
61
views
Django server does not accept cookies
When I try to send a POST request to the DJANGO app hosted on the server, with included credentials in the Axios request or with a Postman app, I cannot access cookies in the app, because cookies are ...
-2
votes
0
answers
30
views
How do you implement an Antiforgery (CSRF) token solution into WPF (xaml.cs) application? [closed]
Our .NET Framework 4.7 solution only includes WPF (xaml.cs) and .cs files. We do NOT use MVC or ASP.net (therefore we don't have GET or POST). User input is accepted from a textbox, thus the input ...
0
votes
0
answers
13
views
The required anti-forgery form field quot;__RequestVerificationToken is not present
I have @Html.AntiForgeryToken() in view and [ValidateAntiForgeryToken] in controll, but still the error is there. Iam trying to access controller through Ajax. my current code as follows:
view:
@...
0
votes
1
answer
30
views
Problems implementing antiforgery token in Angular 15 with NET 6 API
I already went through a lot of posts here on how to do this but nothing that works so far.
I used this piece of code in my startup.cs:
public IServiceProvider ConfigureServices(IServiceCollection ...
-1
votes
0
answers
40
views
Samesite cookie CSRF
I am creating an educational course and creating a small exercise such that if the user logs in to mail.xyz:8081, we have two cookies set that is PHPSESSID and test_cookie (both set to Lax). Now there ...
0
votes
0
answers
17
views
CSRF TOKEN per session
How can I generate a single csrf token per session and it does not change by request with google as the login in java?
I enable csrf token
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository....
0
votes
0
answers
16
views
CSRF token missing when making a POST request via Hoppscotch to Django
I'm working with a Django (version 4.0+) application and facing a CSRF verification issue when trying to make a POST request using Hoppscotch. I'm receiving the following error:
{
"detail": &...
0
votes
0
answers
42
views
Rails: ActionController::InvalidAuthenticityToken when setting first address created as default
I'm encountering an issue in my Rails application where I get ActionController::InvalidAuthenticityToken when trying to set the first address as default. The error occurs during the create action in ...
0
votes
1
answer
28
views
Symfony & VueJS CSRF Token Validation Issue: 'Invalid CSRF Token' Error
I am working on a web application using Symfony for the backend and VueJS 3.2 for the frontend, and I am facing a persistent issue with CSRF token validation. Despite several attempts and checks, I ...
0
votes
0
answers
18
views
Erro 419 Page expired when try to save form in Botman - Laravel 9
Hi i man using botman chatbot and when i try to save my form it shows me error 419 page expired and when i try that form in a normal balde.php it save i don't know why here is my full code :
{
...
0
votes
0
answers
8
views
Writing Unit Tests for Anti-Xsrf Tokens for ASP Web Form
Hi I am using the following auto-generated code and was having difficulty creating unit tests for this and was wondering if anyone could help. I have posted the code below. I am mainly having ...
1
vote
1
answer
31
views
CSRF token mismatch: Nuxt with Symfony (pimcore) backend
Setup:
nuxt on docker container
pimcore on another docker container
in nuxt config:
env: {
apiDomain: process.env.VUE_APP_API_DOMAIN || "http://localhost:8000/api",
...
-1
votes
1
answer
109
views
Vue3 + Quasar SPA trying to authenticate with a Laravel API and getting a CSRF token mismatch (419 status code)
I have a application SPA Vue3 + Quasar and a backend Laravel API, on same domain (localhost), my SPA is on port 8080 and my API on port 80.
In SPA, every time my page refresh, I send a GET to /sanctum/...
1
vote
0
answers
22
views
CSRF token is always invalid in Symfony forms if I use custom token authenticator and stateless is set to false
security.yaml
security:
providers:
my_user_provider:
id: CustomUserProvider
firewalls:
main:
provider: my_user_provider
stateless: false
custom_authenticators:
...
0
votes
0
answers
13
views
Is there any valid reason why gem omniauth-rails_csrf_protection in only Rails 4.2+ compatible?
I was wondering is there any valid reason why omniauth-rails_csrf_protection is not compatible with the versions of Rails below 4.2? Are there some functionalities in Rails 4.2+ that are crucial for ...
0
votes
2
answers
56
views
CSRF client side double submission token generation
I am looking into protecting a website from CSRF attacks. Although sensitive cookies already are tagged with same-site=lax, I would still like to implement CSRF tokens. More specifically the double ...
-1
votes
1
answer
49
views
Why Expect: 100 Continue header splitting response in 2
I am a security researcher while researching on a project I found that when I insert Expect: 100-continue header in request response comes like this :
HTTP/1.1 100 Continue\cr\lf
\cr\lf
HTTP/...
0
votes
0
answers
37
views
why am i getting 403 Forbidden error on RequestMatchers(HttpMethod.POST,"/login").permitAll()
why am i getting this 403 error?
when i do RequestMatchers(HttpMethod.POST).permitAll() it works fine but when i do RequestMatchers(HttpMethod.POST,"/login").permitAll() it throws me 403 ...
0
votes
1
answer
83
views
Disable Vaadin CSRF
I'm using Vaadin 24.2 + Springboot 3.1.5 and Spring Security
So, according to this: Vaadin Docs
All requests between the client and the server are included with a user-session-specific CSRF token. ...
0
votes
1
answer
16
views
CSRF protection if form tag not present
We have a page with a bunch of radio input fields and a button. On click of the button, the value of the radio selected is added in window.location.href using javascript.
Do we need to apply any ...
0
votes
0
answers
65
views
I want to disable CSRF for a webhook endpoint in webflux/kotlin/spring boot 3 app
I have the following code:
@Bean
fun configure(http: ServerHttpSecurity): SecurityWebFilterChain {
// @formatter:off
return http
.authorizeExchange { it.pathMatchers(GET, *...
0
votes
0
answers
35
views
Anti-CSRF tokens in HTML and PHP
I'm trying to implement anti-CSRF tokens in this html form, which is submitted via POST and Javascript to the PHP API, but when searching for vulnerabilities it remains as I wouldn't have tried ...
0
votes
1
answer
121
views
CSRF doesn't get disabled by .csrf().disable()
I'm currently using Springboot 1.5.8 with Spring Security and I'm testing the basic authentication.
I wrote a simple function that permits all authenticated requests to use a test function:
@...
0
votes
0
answers
35
views
NextAuth csrfToken from REST API does not match csrfToken in request headers
On my page, I am obtaining a csrfToken from NextAuth's getCsrToken (see https://next-auth.js.org/getting-started/client#getcsrftoken) and this value is included in a hidden form field named csrfToken:
...
3
votes
1
answer
309
views
X-XSRF-TOKEN header automatic generation in [email protected]
I get frustrated populating the X-XSRF-TOKEN header based on the value of the XSRF-TOKEN cookie, and then send the request to a trusted host.
That issue comes with the breaking change in axios library ...
1
vote
0
answers
34
views
Making Angular add X-XSRF-TOKEN header despite having not root cookie
In our application (frontend is in angular, backend in java) there's the problem of not adding the X-XSRF-TOKEN header on a request, resulting in backend returning 403 (forbidden).
The xsrf mechanism ...
0
votes
0
answers
30
views
Session token without 'SameSite' attribute is not being included in the request when victim is lured to execute CSRF attack
I am simulating a Cross Site Request Forgery (CSRF) attack to site X. The site sets its session ID using:
Set-Cookie: PHPSESSID=abcdefg; path=/; HttpOnly
As there's no SameSite attribute defined, I'm ...
0
votes
0
answers
33
views
CSRF token is missing - React Frontend form with Flask backend
I have a Flask backend with postresql hosted on Render, and I'm developing a separate React frontend locally. I'm encountering issues related to CSRF tokens when making POST requests relating to ...
1
vote
1
answer
47
views
JWT (XSS) vs Cookies (CSRF)?
I'm a Python backend developer at a start-up. Recently, I was asked to build the authentication system for APIs, and I implemented a token-based authentication mechanism (JWT) using the FastAPI ...
0
votes
0
answers
17
views
Accept data from embedded widget with Laravel backend
I am currently developing a lightweight application, a key feature of which is an iframe widget. This widget, designed to collect basic information (name and email) via a simple form, is intended for ...
2
votes
0
answers
47
views
how to add #{authenticityToken /} to all playframework forms
I am using playframework 1.7 and i want to inject #{authenticityToken /} to each and every form as mentioned in https://www.playframework.com/documentation/1.2.5/security under the Cross-Site Request ...
0
votes
0
answers
24
views
Only GET request is working with basic spring security authentication
I am trying to secure my endpoints but only get request works with default username and password,
Here is my security configuration file:
package com.expense_tracker.expenseTracker.Config;
import org....
0
votes
1
answer
101
views
How to configure CSRF Token in SpringBoot 2.7
We are building a simple app with SpringBoot 2.7 and are running into issues with the CSRF token setup. User operations (POST requests) return 403 forbidden. This is contained in an AWS ecs cluster ...
1
vote
0
answers
47
views
Angular how to get XSRF-TOKEN cookie
Hi i want to add CSRF protection to my app
I have an angular app in front and spring in backend
In backend i have this configuration
.csrf(csrf -> csrf.csrfTokenRepository(getCsrfTokenRepository()...
0
votes
0
answers
25
views
How to setup CSRF Trusted Origina domain on same server as Django docker app in plesk?
I currently have a django app installed on a Docker in Plesk. Id like to keep everything to basically localhost for any domain that I have hosted on the same server.
The only thing that works is ...
1
vote
1
answer
74
views
Cross-Site Request Forgery Prevention: using a cookie for the Synchronizer Token Pattern
The OWASP description of the Synchronizer Token Pattern for CSRF Prevention (here) states:
For the Synchronised Token Pattern, CSRF tokens should not be transmitted using cookies.
My understanding ...
0
votes
0
answers
77
views
CSRF token mismatch error on any form submission in Laravel
I have recently deployed a Laravel application on AWS EC2 and configured it to be served through the Nginx web server. The website functions flawlessly when accessed locally. However, when accessing ...
0
votes
0
answers
31
views
why hmac-csrf-token store the csrf token in cookie?
In OWASP CSRF, it introudce HMAC CSRF TOKEN. I'm confused why hmac-csrf-token store the csrf token in cookie?
response.setCookie("csrf_token=" + csrfToken + "; Secure)
If csrf token ...
0
votes
0
answers
32
views
Laravel CSRF token for API (prod API access from localhost and prod site)
What's the best practise when it comes to developing FE &BE regarding Laravel Sanctum / CSRF?
I built my app with Laravels CSRF token auth, as on the site (10.x) says that's recommended for SPAs....
0
votes
0
answers
53
views
CSRF token invalidated when browser back button is clicked
I have enabled the CSRF protection on the login page as advised in the link below and got it working,
Expected CSRF token not found. Has your session expired 403
Unfortunately it is failing in the ...
0
votes
1
answer
41
views
Can't edit anything in Django CMS due to cross-origin error
About three months ago, I upgraded our old Django and CMS application to the (then) latest LTS versions (4.2.3 for Django, 3.11.3 for django-cms). After the upgrade, I got the following error when I ...
-1
votes
1
answer
31
views
csrf_exempt true on all callbacks
I've created some custom middleware for my django rest api to enforce a CSRF security policy of setting custom headers. I've subclassed CsrfViewMiddleware and overriden a few methods to suite my needs,...