Difference between revisions of "Talk:Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet"

From OWASP
Jump to: navigation, search
(→‎Don't post theoretical attacks, or "here say" on any OWASP page.: new section)
Line 1: Line 1:
−
Checking Referer Header is used to patch the most dangerous CSRF vulnerability ever discovered (which was by me http://www.kb.cert.org/vuls/id/643049 Michael Brooks).  This article is incorrect and I am chaining it.  If you have a problem then you should contact me,  but as it stands I cannot allow this page to spread false information.
 
−
 
−
----
 
−
 
−
That is not the most dangerous CSRF vuln ever discovered! You are either really full of yourself, or you know very little about CSRF. I have found CSRF bugs that could have trivially been exploited for millions of dollars of theft, and those aren't the worst ones out there. I'm going to update the Referer Header section to be more accurate and include GET-based CSRF attacks (such as open redirection, probably from the login page) that referer checking usually doesn't cover either (which is one of it's biggest flaws).
 
−
 
 
== Don't post theoretical attacks,  or "here say" on any OWASP page. ==
 
== Don't post theoretical attacks,  or "here say" on any OWASP page. ==
  

Revision as of 22:42, 24 August 2012

Don't post theoretical attacks, or "here say" on any OWASP page.

Look people. A referer check is a valid form of protection and is currently being used to stop the most dangerous CSRF vulnerability ever discovered (according to the DHS: http://www.kb.cert.org/vuls/id/643049). If you think it be exploited, PROVE IT. Stop spreading clearly false information on OWASP.

Write an exploit and show me that it works. Then you can change the owasp wiki.

Retrieved from "https://wiki.owasp.org/index.php?title=Talk:Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet&oldid=134756"