CSRF: Cross-Site Request Forgeries

Google also did a very good job introducing security vulnerabilities, and also a sandbox for trying them out. Their take at Cross-Site Request Forgery: <a href="http://google-gruyere.appspot.com/part3#3__cross_site_request_forgery" rel="nofollow">http://google-gruyere.appspot.com/part3#3__cross_site_reques...</a><p>The sandbox: <a href="http://google-gruyere.appspot.com/start" rel="nofollow">http://google-gruyere.appspot.com/start</a>

* These are submitted with a form (over POST, hopefully) *<p>I don't think that the author implies that using POST prevents CSRFs but the article seems to imply it. In case anyone thinks it is the case: using POST won't prevent a CSRF.<p>Cross Site Request Forgeries occur when a user opens an "evil" page on site B, while being logged on site A. If site A solely relies on cookies in order to identify logged users, there is a risk of CSRF. The attack exploits the fact that the user's browser will always send the auth cookies when issuing a request to siteA. If the evil page on siteB embeds an image (or script, or any resource that can be loaded using an URL) whose source is an URL on siteA, the browser will request the resource on siteA with the auth cookie coming along.<p>In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.

This is a decent article, but it's really just another "use your framework to mitigate CSRF" article. There's probably been hundreds of them in the last five years. Useful for junior devs who haven't seen it before; uninteresting for most everyone else.

A simple explanation for the non tech folks: <a href="http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks-in-non-geek-speak.html" rel="nofollow">http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks-in-n...</a>

One thing that's not covered by a lot of frameworks is protecting against CSRF in AJAX requests. Django has some info on enabling this (<a href="https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax" rel="nofollow">https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax</a>), but it's easy to overlook.

Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable<p>edit: maybe not grey but some colour which doesn't contrast with brown at all

Perhaps I'm just nieve but if someone has access to the DOM via XSS; isn't CSRF nonces like Django uses pointless?