new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

csrf/token_transmission

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

CSRF token transmission via hidden form field

CSRF tokens can be transmitted in HTML responses and submitted back as hidden form fields. Example: <form action="/transfer.do" method="post"><input type="hidden" name="CSRFToken" value="OWY4NmQwODE4ODRjN2Q2NTlhMmZlYWEwYzU1YWQwMTVhM2JmNGYxYjJiMGI4MjJjZDE1ZDZMGYwMGEwOA==">[...]</form>. Tokens must not be transmitted in cookies, leaked in server logs, or exposed in URLs. GET requests can leak tokens in browser history, log files, network utilities, and Referer headers.

CSRF token transmission via custom HTTP header

It is more secure to insert the CSRF token in a custom HTTP request header via JavaScript than adding it as a hidden form field parameter. Since requests with custom headers are automatically subject to the same-origin policy, this approach provides stronger protection against CSRF attacks.

Give your agent this brain