The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery

on YouTube ↗52m

" summary

Cross-site forgery is largely neutralized by SameSite cookies for typical cookie-auth apps, but APIs remain vulnerable because forms and fetch can deliver JSON-like payloads when servers accept wrong content types. Demos show form-encoded or fetch attacks creating reviews and messages; real incidents involve dangling CNAMEs and subdomain takeover. Defenses that actually work: synchronizer tokens for legacy apps, require exact Content-Type and use CORS preflight or a custom header enforcer (X-CSRF) + test endpoints to reject text/plain with JSON payloads.

AI-written summary · about

" chapters (15)

1. 0:00Introduction to Cross-Site Request Forgery
2. 1:10What is CSRF
3. 5:23Live demo: CSRF attack
4. 8:32Introduction
5. 10:17Traditional CSRF defenses
6. 13:48SameSite cookies
7. 18:25Chrome's SameSite default impact
8. 21:14CSRF in API apps
9. 24:42Live demo: API CSRF
10. 29:21CORF explained
11. 33:19SameSite vs CORF
12. 35:23Content-type vulnerabilities in APIs
13. 42:01API defenses: CORS & headers
14. 48:19Choosing CSRF defenses
15. 50:48Key takeaways

" related talks

• 47mKeynote: Request Forgery on the Web - SSRF, CSRF and ClickjackingJim Manico · Global AppSec US 2021 Virtual
• 18mWriting an (in)secure webappAdam Baldwin · JSConf US 2011
• 25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORSJianjun Chen · USENIX Security '18
• 36mCSRF Vulnerabilities Are Still RelevantMikhail Egorov · HighLoad++ 2017
• 40mMisconfigured CORS and why web appsec is not getting easierEvan Johnson · AppSecUSA 2016
• 31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯Dominik Kundel · JSHeroes 2018
• 30mSingle Page Applications: Is your design secure?Rafael Dreher, Murali Vadakke Puthanveetil · OWASP AppSec USA 2018
• 18mCORS, XSS, CSRF, SQL injection #BackToTheBasicsAdrien Pessu · DevFest Paris 2019