csrf/client_side

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Client-side CSRF attack definition

Client-side CSRF is a variant where an attacker tricks client-side JavaScript code to send a forged HTTP request to a vulnerable target site by manipulating the program's input parameters. Client-side CSRF originates when JavaScript uses attacker-controlled inputs (URL, window.name, document.referrer, postMessages) for generation of asynchronous HTTP requests. This variant can bypass common anti-CSRF countermeasures like token-based mitigations and SameSite cookies because the JavaScript program includes them in asynchronous requests.

Client-side CSRF vulnerable pattern example

Vulnerable code pattern: JavaScript function reads URL hash fragment and uses it to generate asynchronous requests. Example: const hashFragment = window.location.hash.slice(1); // e.g., post;/profile. If params extracted from hash are used directly in fetch() endpoint and method parameters: fetch(requestEndpoint, { method: requestMethod, ... }), an attacker can craft malicious URL with attack payload in hash fragment. Users clicking link from phishing email or prerender hints execute the attack.

Client-side CSRF mitigation - independent requests

Client-side CSRF can be prevented by ensuring asynchronous requests cannot be generated via attacker-controllable inputs such as: URL (window.location), window.name, document.referrer, postMessages. Maintain independence between user-controlled inputs and request parameters used for HTTP requests.

Client-side CSRF mitigation - input validation

When complete isolation between inputs and request parameters is not possible, implement strict input validation checks. These checks should assess the format and choice of request parameter values and restrict them to non-state-changing operations only (e.g., allow only GET requests and endpoints starting with predefined prefix).

Client-side CSRF mitigation - predefined request data

Store a list of predefined, safe request data in JavaScript code (combinations of endpoints, request methods, and other parameters that are safe to be replayed). Use a switch parameter in URL fragment to decide which entry from the predefined list each JavaScript function should use. This prevents attackers from specifying arbitrary endpoints or methods.

Give your agent this brain