Cross-site request forgery (CSRF)
Challenges
- CSRF lab: No defenses
- CSRF lab: Token validation depends on request method
- CSRF lab: Token validation depends on token being present
- CSRF lab: Token not tied to user session
- CSRF lab: Token tied to non-session cookie
- CSRF lab: Token duplicated in cookie
- CSRF lab: SameSite Lax bypass via method override
- CSRF lab: SameSite Strict bypass via client-side redirect
- CSRF lab: SameSite Strict bypass via sibling domain
- CSRF lab: SameSite Strict bypass via cookie refresh
- CSRF lab: Referer validation depends on header being present
- CSRF lab: Referer validation broken
Resources
Last updated on