new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

csrf/hmac_tokens

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

HMAC CSRF token generation algorithm

To generate HMAC CSRF tokens: (1) Gather: secret key from secure storage (CSRF_SECRET), current authenticated user session ID, cryptographic random value (64 bits); (2) Create message payload: sessionID.length + '!' + sessionID + '!' + randomValue.length + '!' + randomValue.toHex(); (3) Generate HMAC: hmac('SHA256', secret, message); (4) Create final token: hmac.toHex() + '.' + randomValue.toHex(); (5) Store in cookie with Secure flag but without HttpOnly flag so JavaScript can access it: response.setCookie('csrf_token=' + csrfToken + '; Secure')

HMAC CSRF token validation algorithm

To validate HMAC CSRF tokens: (1) Get CSRF token from request parameter or header (NOT from cookie); (2) Split token by '.' to extract hmacFromRequest and randomValue; (3) Recreate HMAC: gather secret key (CSRF_SECRET) and current session ID, create message as sessionID.length + '!' + sessionID + '!' + randomValue.length + '!' + randomValue, generate expectedHmac = hmac('SHA256', secret, message); (4) Use constantTimeEquals() to compare hmacFromRequest with expectedHmac to prevent timing attacks; (5) If comparison fails, reject request with 403 error and log the mismatch.

Give your agent this brain