Keynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking
summary
Explains concrete attacks and fixes: Cross‑Site Request Forgery lets an attacker force authenticated actions; defenses that work are synchronizer token, double-submit cookie, re‑auth for critical actions and SameSite=strict cookies (Chrome 80 sets Lax by default). Server‑Side Request Forgery causes Capital One to leak ~100 million records and a Brazilian router flaw hits ~5 million users; fix by validating/encoding URLs, network controls and backend access checks. Clickjacking blocks with X‑Frame‑Options or CSP frame-ancestors. Tools like ZAP/Burp/DAST find many of these issues.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 2:06What is request forgery
- 3:18Examples
- 6:01Crosssite request forgery
- 7:18Netflix request forgery
- 9:30Single signon
- 12:17Traditional Web Apps
- 13:09Get Requests
- 13:59Double Submit
- 15:50Browser Standards
- 18:24Same site lacks
- 19:10Cookie defense
- 20:31Check origin header
- 20:59Control origin header
- 21:24Crosssite scripting
- 21:37Twitter attack
- 22:22Crosssite request forgery cheat sheet
- 23:19Serverside request forgery
- 24:05Capital One case
- 27:38From another angle
- 28:09SSRF attack
- 29:08How to fix
- 29:39SSRF
- 29:50Summary
- 31:22Questions
- 32:21Web Frameworks
- 37:24Service on request forgery
- 43:21Clickjacking
- 44:36XFrameOptions
related talks
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
36mCSRF Vulnerabilities Are Still Relevant
46mNavigating The Landscape Of Client-Side Request Hijacking On The Web
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
42mHack Me If You Can
28mXSS, CSRF, CSP, JWT, Wtf? Idk
33mHacking The Front-End