CSRF - secuguru/security-terms GitHub Wiki

Cross-Site Request Forgery (CSRF) is a web security vulnerability that allows an attacker to trick a user into performing unwanted actions on a trusted website where the user is authenticated. CSRF exploits the trust that a website has in a user’s browser, primarily through the misuse of cookies for authentication.

1. Victim Authentication:

• The victim logs into a trusted website (e.g., example.com), which sets an authentication cookie in their browser.

2. Attacker’s Setup:

• The attacker crafts a malicious link or form on their own website (or a compromised site) that sends a request to the trusted website.

3. Unintentional Action:

• The victim clicks the malicious link or visits the attacker’s page, which triggers a request to the trusted website.
• Since the victim’s browser automatically includes the authentication cookie with the request, the trusted website processes it as if it came from the authenticated user.

• Cookies are automatically sent with requests to the domain that set them, regardless of where the request originates.
• CSRF attacks exploit this behavior to send authenticated requests on behalf of the user without their knowledge.

• The victim is logged into bank.com and has an active session authenticated via cookies.

• The attacker hosts a page with the following code:

<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="to" value="attacker_account">
  <input type="hidden" name="amount" value="1000">
  <input type="submit" value="Click me for a surprise!">
</form>

• The victim, while still logged into bank.com, visits the attacker’s page and clicks the form submission button (or the form is submitted automatically via JavaScript).
• The request to https://bank.com/transfer includes the victim’s valid cookies, and the server processes the transfer.

• Include a unique CSRF token in each form or request that is validated by the server.
• Example:
  • The server generates a token and embeds it in a form:
  • The server validates the token when processing the form submission.

<input type="hidden" name="csrf_token" value="random_token123">

• Use the SameSite attribute to restrict cookies from being sent with cross-site requests:
  • Strict: Cookies are sent only for requests originating from the same site.
  • Lax: Cookies are sent for top-level navigation but not for background requests.
  • Example:

Set-Cookie: sessionId=abc123; SameSite=Strict

• Re-authenticate users or require additional confirmation (e.g., OTP, password) for critical actions.

• Configure servers to only accept cross-origin requests from trusted origins.

• Validate that the Referer header of incoming requests matches the trusted domain.

• Backend (Python Flask Example):

from flask import Flask, request, render_template_string, session
import secrets

app = Flask(__name__)
app.secret_key = 'secret_key'

@app.route('/form', methods=['GET'])
def form():
    csrf_token = secrets.token_hex(16)
    session['csrf_token'] = csrf_token
    return render_template_string('''
    <form method="POST" action="/submit">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
        <input type="text" name="data">
        <input type="submit">
    </form>
    ''', csrf_token=csrf_token)

@app.route('/submit', methods=['POST'])
def submit():
    if request.form['csrf_token'] != session.get('csrf_token'):
        return "CSRF Attack Detected!", 403
    return "Form submitted successfully!"

• Example in Express.js (Node.js):

app.use(cookieSession({
  name: 'session',
  keys: ['key1', 'key2'],
  cookie: {
    secure: true,
    httpOnly: true,
    sameSite: 'Strict'
  }
}));

• Exploitation of Trust:
  • The attack leverages the fact that servers inherently trust cookies sent by the browser.
• Silent Execution:
  • The victim often has no idea their session has been hijacked or actions have been performed.
• Broad Impact:
  • Any application that relies on cookies for authentication is susceptible if not properly protected.

CSRF is a critical vulnerability that exploits the way cookies are automatically sent with requests. Implementing robust defenses, such as CSRF tokens and SameSite cookies, is essential to secure web applications from this threat. By understanding how CSRF works and its interaction with cookies, developers can build safer and more secure web applications.