Questions tagged [csrf]

Cross Site Request Forgery is a malicious attack to exploit a website's trust in a user's browser.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Problems with CSRF token in Django REST Framework integration with React

I'm doing a website using Django REST Framework as a backend with session authentication, React in the frontend and django-cors-headers to communicate between the two. Each is served in the same IP ...
Pol Ortiz's user avatar
0 votes
0 answers
12 views

How to test with MockMVC and CSRF in Spring Boot 3

I have a SpringBoot MockMVC Test where I want to test a post endpoint like this: @AutoConfigureTestEntityManager @SpringBootTest @AutoConfigureMockMvc class MyControllerTest { @Autowired ...
Kira Resari's user avatar
  • 1,838
0 votes
0 answers
7 views

CSRF-TOKEN Issues while parsing the GET Request

While parsing the GET Request HTTP call I received a 400 Bad Request Error and if I checked the request data, I could see some errors under the cookie header CSRF-TOKEN. (https://i.stack.imgur.com/...
Vithyatharan Surya's user avatar
0 votes
0 answers
32 views

Develop Angular SPA on localhost and query the remote staging API

I have troubles setting up my development environment. I am attempting to develop an Angular SPA which should, in the end, communicate with a Laravel backend that is hosted under the same top domain ...
NeebletWorm's user avatar
0 votes
0 answers
18 views

SpringBoot - How I can configure samesite none Csrf Cookie

What I have: I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it. I only grant access by cors to my angular domain app. What I need: I need ...
David Burgos's user avatar
0 votes
2 answers
85 views

Laravel @csrf empty value

The result generated by @csrf in Blade <input type="hidden" name="_token" value=""> Also tried {!! csrf_field() !!} and {{ csrf_field() }} but still there is no ...
Arsalan Khan's user avatar
0 votes
0 answers
11 views

How do Samesite cookies work when frontend and backend are on different domains?

I'm new to backend development and I'm trying to learn about preventing CSRF attacks. I read that Samesite cookies can help, but I struggle to see how in certain situations. Let's say I have a website ...
b0rtz1's user avatar
  • 1
0 votes
0 answers
10 views

Is CSRF attack possible for API authenticating with cookie but not using forms?

I understand the mechanism of the CSRF attack with the form post, but I do not get how it is possible to send a post request from a malicious site. Imagine I have SPA at origin S, Web API at origin A, ...
Pavel Voronin's user avatar
0 votes
1 answer
61 views

Django server does not accept cookies

When I try to send a POST request to the DJANGO app hosted on the server, with included credentials in the Axios request or with a Postman app, I cannot access cookies in the app, because cookies are ...
Nikola's user avatar
  • 59
-2 votes
0 answers
30 views

How do you implement an Antiforgery (CSRF) token solution into WPF (xaml.cs) application? [closed]

Our .NET Framework 4.7 solution only includes WPF (xaml.cs) and .cs files. We do NOT use MVC or ASP.net (therefore we don't have GET or POST). User input is accepted from a textbox, thus the input ...
Fokie's user avatar
  • 1
0 votes
0 answers
13 views

The required anti-forgery form field quot;__RequestVerificationToken is not present

I have @Html.AntiForgeryToken() in view and [ValidateAntiForgeryToken] in controll, but still the error is there. Iam trying to access controller through Ajax. my current code as follows: view: @...
Alsamil Mehboob's user avatar
0 votes
1 answer
30 views

Problems implementing antiforgery token in Angular 15 with NET 6 API

I already went through a lot of posts here on how to do this but nothing that works so far. I used this piece of code in my startup.cs: public IServiceProvider ConfigureServices(IServiceCollection ...
DEVCODER's user avatar
-1 votes
0 answers
40 views

Samesite cookie CSRF

I am creating an educational course and creating a small exercise such that if the user logs in to mail.xyz:8081, we have two cookies set that is PHPSESSID and test_cookie (both set to Lax). Now there ...
Johnny's user avatar
  • 1,741
0 votes
0 answers
17 views

CSRF TOKEN per session

How can I generate a single csrf token per session and it does not change by request with google as the login in java? I enable csrf token http.csrf().csrfTokenRepository(CookieCsrfTokenRepository....
Melia's user avatar
  • 1
0 votes
0 answers
16 views

CSRF token missing when making a POST request via Hoppscotch to Django

I'm working with a Django (version 4.0+) application and facing a CSRF verification issue when trying to make a POST request using Hoppscotch. I'm receiving the following error: { "detail": &...
Ixyz's user avatar
  • 25
0 votes
0 answers
42 views

Rails: ActionController::InvalidAuthenticityToken when setting first address created as default

I'm encountering an issue in my Rails application where I get ActionController::InvalidAuthenticityToken when trying to set the first address as default. The error occurs during the create action in ...
jtlwell's user avatar
  • 11
0 votes
1 answer
28 views

Symfony & VueJS CSRF Token Validation Issue: 'Invalid CSRF Token' Error

I am working on a web application using Symfony for the backend and VueJS 3.2 for the frontend, and I am facing a persistent issue with CSRF token validation. Despite several attempts and checks, I ...
alexdoobre's user avatar
0 votes
0 answers
18 views

Erro 419 Page expired when try to save form in Botman - Laravel 9

Hi i man using botman chatbot and when i try to save my form it shows me error 419 page expired and when i try that form in a normal balde.php it save i don't know why here is my full code : { ...
Abdellah Hajjam's user avatar
0 votes
0 answers
8 views

Writing Unit Tests for Anti-Xsrf Tokens for ASP Web Form

Hi I am using the following auto-generated code and was having difficulty creating unit tests for this and was wondering if anyone could help. I have posted the code below. I am mainly having ...
Kevin Po's user avatar
1 vote
1 answer
31 views

CSRF token mismatch: Nuxt with Symfony (pimcore) backend

Setup: nuxt on docker container pimcore on another docker container in nuxt config: env: { apiDomain: process.env.VUE_APP_API_DOMAIN || "http://localhost:8000/api", ...
gvanto's user avatar
  • 1,966
-1 votes
1 answer
109 views

Vue3 + Quasar SPA trying to authenticate with a Laravel API and getting a CSRF token mismatch (419 status code)

I have a application SPA Vue3 + Quasar and a backend Laravel API, on same domain (localhost), my SPA is on port 8080 and my API on port 80. In SPA, every time my page refresh, I send a GET to /sanctum/...
j_gomes's user avatar
1 vote
0 answers
22 views

CSRF token is always invalid in Symfony forms if I use custom token authenticator and stateless is set to false

security.yaml security: providers: my_user_provider: id: CustomUserProvider firewalls: main: provider: my_user_provider stateless: false custom_authenticators: ...
sabat's user avatar
  • 146
0 votes
0 answers
13 views

Is there any valid reason why gem omniauth-rails_csrf_protection in only Rails 4.2+ compatible?

I was wondering is there any valid reason why omniauth-rails_csrf_protection is not compatible with the versions of Rails below 4.2? Are there some functionalities in Rails 4.2+ that are crucial for ...
Milos's user avatar
  • 356
0 votes
2 answers
56 views

CSRF client side double submission token generation

I am looking into protecting a website from CSRF attacks. Although sensitive cookies already are tagged with same-site=lax, I would still like to implement CSRF tokens. More specifically the double ...
Bram  Vanbilsen's user avatar
-1 votes
1 answer
49 views

Why Expect: 100 Continue header splitting response in 2

I am a security researcher while researching on a project I found that when I insert Expect: 100-continue header in request response comes like this : HTTP/1.1 100 Continue\cr\lf \cr\lf HTTP/...
New Acc's user avatar
0 votes
0 answers
37 views

why am i getting 403 Forbidden error on RequestMatchers(HttpMethod.POST,"/login").permitAll()

why am i getting this 403 error? when i do RequestMatchers(HttpMethod.POST).permitAll() it works fine but when i do RequestMatchers(HttpMethod.POST,"/login").permitAll() it throws me 403 ...
Sugali Yougender's user avatar
0 votes
1 answer
83 views

Disable Vaadin CSRF

I'm using Vaadin 24.2 + Springboot 3.1.5 and Spring Security So, according to this: Vaadin Docs All requests between the client and the server are included with a user-session-specific CSRF token. ...
Mei Mariang's user avatar
0 votes
1 answer
16 views

CSRF protection if form tag not present

We have a page with a bunch of radio input fields and a button. On click of the button, the value of the radio selected is added in window.location.href using javascript. Do we need to apply any ...
NewbieHere's user avatar
0 votes
0 answers
65 views

I want to disable CSRF for a webhook endpoint in webflux/kotlin/spring boot 3 app

I have the following code: @Bean fun configure(http: ServerHttpSecurity): SecurityWebFilterChain { // @formatter:off return http .authorizeExchange { it.pathMatchers(GET, *...
Shaunyl's user avatar
  • 526
0 votes
0 answers
35 views

Anti-CSRF tokens in HTML and PHP

I'm trying to implement anti-CSRF tokens in this html form, which is submitted via POST and Javascript to the PHP API, but when searching for vulnerabilities it remains as I wouldn't have tried ...
Javier Arambarri Calvo's user avatar
0 votes
1 answer
121 views

CSRF doesn't get disabled by .csrf().disable()

I'm currently using Springboot 1.5.8 with Spring Security and I'm testing the basic authentication. I wrote a simple function that permits all authenticated requests to use a test function: @...
Giovanni Grana's user avatar
0 votes
0 answers
35 views

NextAuth csrfToken from REST API does not match csrfToken in request headers

On my page, I am obtaining a csrfToken from NextAuth's getCsrToken (see https://next-auth.js.org/getting-started/client#getcsrftoken) and this value is included in a hidden form field named csrfToken: ...
jjunsa's user avatar
  • 47
3 votes
1 answer
309 views

X-XSRF-TOKEN header automatic generation in [email protected]

I get frustrated populating the X-XSRF-TOKEN header based on the value of the XSRF-TOKEN cookie, and then send the request to a trusted host. That issue comes with the breaking change in axios library ...
Valentin Panov's user avatar
1 vote
0 answers
34 views

Making Angular add X-XSRF-TOKEN header despite having not root cookie

In our application (frontend is in angular, backend in java) there's the problem of not adding the X-XSRF-TOKEN header on a request, resulting in backend returning 403 (forbidden). The xsrf mechanism ...
Joe D's user avatar
  • 74
0 votes
0 answers
30 views

Session token without 'SameSite' attribute is not being included in the request when victim is lured to execute CSRF attack

I am simulating a Cross Site Request Forgery (CSRF) attack to site X. The site sets its session ID using: Set-Cookie: PHPSESSID=abcdefg; path=/; HttpOnly As there's no SameSite attribute defined, I'm ...
rifqy abdl's user avatar
0 votes
0 answers
33 views

CSRF token is missing - React Frontend form with Flask backend

I have a Flask backend with postresql hosted on Render, and I'm developing a separate React frontend locally. I'm encountering issues related to CSRF tokens when making POST requests relating to ...
Cas's user avatar
  • 1
1 vote
1 answer
47 views

JWT (XSS) vs Cookies (CSRF)?

I'm a Python backend developer at a start-up. Recently, I was asked to build the authentication system for APIs, and I implemented a token-based authentication mechanism (JWT) using the FastAPI ...
BooRuleDie's user avatar
0 votes
0 answers
17 views

Accept data from embedded widget with Laravel backend

I am currently developing a lightweight application, a key feature of which is an iframe widget. This widget, designed to collect basic information (name and email) via a simple form, is intended for ...
TheBigK's user avatar
  • 461
2 votes
0 answers
47 views

how to add #{authenticityToken /} to all playframework forms

I am using playframework 1.7 and i want to inject #{authenticityToken /} to each and every form as mentioned in https://www.playframework.com/documentation/1.2.5/security under the Cross-Site Request ...
jasraj bedi's user avatar
0 votes
0 answers
24 views

Only GET request is working with basic spring security authentication

I am trying to secure my endpoints but only get request works with default username and password, Here is my security configuration file: package com.expense_tracker.expenseTracker.Config; import org....
Musab Shaikh's user avatar
0 votes
1 answer
101 views

How to configure CSRF Token in SpringBoot 2.7

We are building a simple app with SpringBoot 2.7 and are running into issues with the CSRF token setup. User operations (POST requests) return 403 forbidden. This is contained in an AWS ecs cluster ...
Markus's user avatar
  • 1
1 vote
0 answers
47 views

Angular how to get XSRF-TOKEN cookie

Hi i want to add CSRF protection to my app I have an angular app in front and spring in backend In backend i have this configuration .csrf(csrf -> csrf.csrfTokenRepository(getCsrfTokenRepository()...
David Medina's user avatar
0 votes
0 answers
25 views

How to setup CSRF Trusted Origina domain on same server as Django docker app in plesk?

I currently have a django app installed on a Docker in Plesk. Id like to keep everything to basically localhost for any domain that I have hosted on the same server. The only thing that works is ...
webcodeme's user avatar
1 vote
1 answer
74 views

Cross-Site Request Forgery Prevention: using a cookie for the Synchronizer Token Pattern

The OWASP description of the Synchronizer Token Pattern for CSRF Prevention (here) states: For the Synchronised Token Pattern, CSRF tokens should not be transmitted using cookies. My understanding ...
davidm_uk's user avatar
  • 688
0 votes
0 answers
77 views

CSRF token mismatch error on any form submission in Laravel

I have recently deployed a Laravel application on AWS EC2 and configured it to be served through the Nginx web server. The website functions flawlessly when accessed locally. However, when accessing ...
Shafayat Alam's user avatar
0 votes
0 answers
31 views

why hmac-csrf-token store the csrf token in cookie?

In OWASP CSRF, it introudce HMAC CSRF TOKEN. I'm confused why hmac-csrf-token store the csrf token in cookie? response.setCookie("csrf_token=" + csrfToken + "; Secure) If csrf token ...
yaqi xu's user avatar
0 votes
0 answers
32 views

Laravel CSRF token for API (prod API access from localhost and prod site)

What's the best practise when it comes to developing FE &BE regarding Laravel Sanctum / CSRF? I built my app with Laravels CSRF token auth, as on the site (10.x) says that's recommended for SPAs....
onemorecoffee's user avatar
0 votes
0 answers
53 views

CSRF token invalidated when browser back button is clicked

I have enabled the CSRF protection on the login page as advised in the link below and got it working, Expected CSRF token not found. Has your session expired 403 Unfortunately it is failing in the ...
Techie's user avatar
  • 83
0 votes
1 answer
41 views

Can't edit anything in Django CMS due to cross-origin error

About three months ago, I upgraded our old Django and CMS application to the (then) latest LTS versions (4.2.3 for Django, 3.11.3 for django-cms). After the upgrade, I got the following error when I ...
thobens's user avatar
  • 1,731
-1 votes
1 answer
31 views

csrf_exempt true on all callbacks

I've created some custom middleware for my django rest api to enforce a CSRF security policy of setting custom headers. I've subclassed CsrfViewMiddleware and overriden a few methods to suite my needs,...
Spencer's user avatar

1
2 3 4 5
93