Skip to content
Hallway
0:00 / 0:00

#csrf#double-submitcookie#owasp

Bypassing CSRF Protections: A Double Defeat of the Double-Submit Cookie - David Johansson

OWASP London

3.9K subscribers • 1 video on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Presented by David Johansson
  • May be out of date. Uploaded 9 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

7.2K views9 years ago1 recommendation

SecurityWeb developmentWeb and application securityExploits and vulnerabilitiesHTTP, REST and GraphQL

David Johansson explains how the double-submit cookie pattern for CSRF protection can be bypassed, focusing on AngularJS and the csurf middleware.

Slide-deck: owasp.org/images/3/32/David_Johansson-Double_Defeat_of_Doubl… Double-Submit Cookie Pattern Protection against cross-site request forgeries (CSRF) is a popular option in stateless applications as it doesn't require the server to store a token value between requests. Instead, the server will verify a token value stored in a cookie against a request parameter. Unfortunately, many popular implementations of this defense pattern can be defeated by attackers and this talk will discuss the misconceptions and pitfalls that may render this protection insufficient. We will look at how the CSRF protection in an AngularJS application using the popular Express.js middleware csurf on the server-side can be defeated. We will also show the options for configuring it securely.

Why it's here

1 person recommends this

What people say. Recommended as a resource explaining why custom or naive CSRF implementations, like those in csurf, are insecure.

u/Psionatixin r/node • Recommends

Secure CSRF alternative to csurf I saw a post recently where someone made their own CSRF alternative for csurf, I commented on that post, as well as on the repo, about how and why their code is insecure - in the same ways that csurf was insecure. For context, you can see 11:30 of this video: link to this video And that wasn't the only thing wrong with that code. However, as someone who actually knows what they are doing and has security experience, I have just updated my Double Submit token pattern middleware utility to have native cjs support in addition to esm: csrf-csrf Version 2.1 brings commonjs support. Also, if you wish to use the Synchronised Token Pattern instead, the sister library csr…
65View on Reddit