Geek asks and answers

The relationship between fake cross-site request and login

I was wondering if there is any connection between login and cross site request? My question is, are there sites that do not have a username but still require CSRF protection? Can you give an example

+3
source share
2 answers

In order for CSRF to be effective, your site just needs to be able to act on behalf of someone so that it does not require explicit authentication or verification.

Subscribe to users using automatically connected cookies, these are the most popular CSRF attacks, but, for example, newsletter subscription forms can be just as vulnerable and can cause people to receive unwanted emails from your system to confirm their subscription.

So, to answer your question, although login and CSRF are related to each other, they are not exclusive to each other.

0
source

CSRF attacks use the authenticity of client requests, since the attacking site is able to fake requests made by the client on behalf of the client, and thus enjoy the trust of servers in client requests. Thus, the server assumes that any request from the client implies the behavior of the user controlling the client. CSRF uses this implicit trust.

, . , , CSRF . , , , (, , , ..).

0

More articles:


All Articles