Why do browsers allow CSRF?

Question

I am new to web security, and when I read more about various attack vectors, my mind is afraid that they are allowed in the first place. It, like the web, was designed with a broken security model and was vulnerable.

I am also amazed at the amount of vague and inaccurate information. For example, at first, a single-origin policy sounds good, and I read that it applies only to XHR, and by the way, it doesn’t really prevent sending a POST XHR Cross-origin POST, which is a classic CSRF attack. Glad I read.

There is also an Origin header that the server can use to make sure the request comes from the right place - but unfortunately it is installed inconsistently in browsers, and if it is NOT installed, you cannot be enough if it is related to the same source request or the type of request that just didn't receive it for certain browsers (maybe an IMG tag?). Keep reading.

So the correct way seems to be to set the CSRF token in the session cookie, and also add this token to the forms / links, and then compare them on the server side in the view. In theory (and allows you to exclude all XSS attacks for the purpose of this question), trying CSRF from another tab can make a POST request to the form containing the cookie, but without the form input element set to the appropriate token (since it cannot read the cookie from the cookie) , so the server will reject the request. Works, but kludgy, and make sure you never forget to check!

A hold that was thought for a second, here is my question - why does the browser send the session cookie to a request that comes from a page that is not the source of the cookie?

I mean, browsers will refuse to send cookies to different domains for a good reason, but would they like to send them from different sources? Will there be breaks if they do not? Would this be reliable CSRF protection, only requiring the servers to do what they do anyway - by checking for a valid session cookie?

Edit: maybe this is an attempt to improve the situation? https://tools.ietf.org/html/draft-west-origin-cookies-01

Answer 1

I am new to web security, and when I read more about different attack vectors, my mind is afraid that they are allowed in the first place. It, like the web, was designed with a compromised security model and be vulnerable.

All right. Firstly, it was never intended to be safe. The web interface was originally designed as a static document management and sharing system that allows direct linking to resources on different machines.

The dynamic website you see today is kludge. We can fix this with CSRF tokens, HTTP headers, etc., but if you make a dynamic website without any of these actions, then the likelihood is that it is vulnerable (and keeps people like me on work).

View your story on the Wikipedia article .

I am also amazed at the amount of vague and inaccurate information. For example, at first the simple origin policy sounds good, then I read that this applies only to XHR, and by the way, and by the way, it doesn’t actually prevent the POST from sending XHR cross origin, which is a classic CSRF attack. Glad I read.

And basically it's true. A policy of the same origin also applies to windows and frames (for example, example.com cannot modify the contents of example.org using JavaScript if example.com includes an IFrame in example.org). Yes, the XHR cross-domain can be executed, but without CORS enabled, responses cannot be read. This protects the CSRF tokens from theft, but as you say, if you do not use CSRF protection, this means the CSRF is vulnerable.

Other protections, such as adding a custom header , can be used to mitigate CSRF, as custom headers cannot be sent cross-domain.

XHR did not have access to anything cross-domain, which was considered too big a restriction, therefore, the emergence of CORS. Previously, since forms could access different domains, this was not considered a particularly risky maneuver. It still does not work, provided that appropriate control measures are implemented.

There is also an Origin header, which the server can use to ensure the request comes from the right place - but, unfortunately, it is installed inconsistently in browsers, and if it is NOT installed, you cannot absolutely correctly if it was due to a request with one the same incident or request type that just didn’t receive it for certain browsers (maybe an IMG tag?). Keep reading.

That's right. See this answer .

why does the browser send the session cookie to the request, which comes from a page that is not the source of the cookie?

Because many things would break otherwise. There are many forms that are designed to be sent from static sites to dynamic sites that perform reverse processing.

There is a new standard for "single site" cookies . A less dry explanation is here .

Mostly cookies can be set with the new SameSite attribute. In strict mode, cookies are not sent when the source is different. In lax mode, they are saved only if this method is, for example, POST, which mainly contains CSRF vulnerabilities.

The one you contacted was an early project of this.