XSRF How it works 3 - form is submitted on bank.com 4 - bank.com - - PowerPoint PPT Presentation

▶

Feb 20, 2023 365 likes •422 views

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com helpfully transfers money into trouts account 2 - evil.fish includes form on bank.com 1-user goes to evil.fish Defenses Form keys Check HTTP referer CSRF

SLIDE 1

XSRF

SLIDE 2

How it works

1-user goes to evil.fish

2 - evil.fish includes form on bank.com

3 - form is submitted

n bank.com

4 - bank.com helpfully transfers money into trout’s account

SLIDE 3

Defenses

Form keys
Check HTTP referer
CSRF tokens
Short cookie expiration date
Encourage users to log out

SLIDE 4

Homework

https://google-gruyere.appspot.com/