The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
summary
CSRF remains real for cookie-based auth: demos show hidden-form and fetch attacks creating reviews against a legacy app and an API, and real incidents include OkCupid and Grafana. Modern defenses work but differ: SameSite cookies stop classical CSRF reliably; APIs must enforce Content-Type and either use synchronizer tokens or force a preflight by requiring a static custom header (an X-CSRF header) so the browser triggers CORS preflight. Subdomain takeover enables cross-origin forgery, so add BFFs, tests for content-type, and DNS hygiene.
AI-written summary · about
chapters (6)
- 0:00Introduction to Cross-Site Request Forgery
- 10:18Traditional CSRF attacks
- 21:14CSRF in API risks
- 29:23CORF explained
- 35:23Defending APIs with CORS
- 48:22CSRF protection summary
related talks
36mCSRF Vulnerabilities Are Still Relevant
47mKeynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
18mCORS, XSS, CSRF, SQL injection #BackToTheBasics
18mWriting an (in)secure webapp
29mDon't Trust, Verify! - How I Found a CSRF Bug Hiding...
27mAuthentication in Single Page Applications
21mDeath to Cookies