Robust defenses for cross-site request forgery Export

@inproceedings{citeulike:4607235, abstract = {Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present a new variation on CSRF attacks, login CSRF, in which the attacker forges a cross-site request to the login form, logging the victim into the honest web site as the attacker. The severity of a login CSRF vulnerability varies by site, but it can be as severe as a cross-site scripting vulnerability. We detail three major CSRF defense techniques and find shortcomings with each technique. Although the HTTP Referer header could provide an effective defense, our experimental observation of 283,945 advertisement impressions indicates that the header is widely blocked at the network layer due to privacy concerns. Our observations do suggest, however, that the header can be used today as a reliable CSRF defense over HTTPS, making it particularly well-suited for defending against login CSRF. For the long term, we propose that browsers implement the Origin header, which provides the security benefits of the Referer header while responding to privacy concerns.}, address = {New York, NY, USA}, author = {Barth, Adam and Jackson, Collin and Mitchell, John C.}, booktitle = {CCS '08: Proceedings of the 15th ACM conference on Computer and communications security}, citeulike-article-id = {4607235}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1455770.1455782}, citeulike-linkout-1 = {http://dx.doi.org/10.1145/1455770.1455782}, doi = {10.1145/1455770.1455782}, isbn = {978-1-59593-810-7}, keywords = {browsers, csrf, login, security, web}, location = {Alexandria, Virginia, USA}, pages = {75--88}, posted-at = {2009-05-23 05:18:48}, priority = {2}, publisher = {ACM}, title = {Robust defenses for cross-site request forgery}, url = {http://dx.doi.org/10.1145/1455770.1455782}, year = {2008} }

TY - CONF ID - citeulike:4607235 L3 - citeulike-article-id:4607235 N2 - Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present a new variation on CSRF attacks, login CSRF, in which the attacker forges a cross-site request to the login form, logging the victim into the honest web site as the attacker. The severity of a login CSRF vulnerability varies by site, but it can be as severe as a cross-site scripting vulnerability. We detail three major CSRF defense techniques and find shortcomings with each technique. Although the HTTP Referer header could provide an effective defense, our experimental observation of 283,945 advertisement impressions indicates that the header is widely blocked at the network layer due to privacy concerns. Our observations do suggest, however, that the header can be used today as a reliable CSRF defense over HTTPS, making it particularly well-suited for defending against login CSRF. For the long term, we propose that browsers implement the Origin header, which provides the security benefits of the Referer header while responding to privacy concerns. CY - Alexandria, Virginia, USA SN - 978-1-59593-810-7 AD - New York, NY, USA EP - 88 TI - Robust defenses for cross-site request forgery PB - ACM T2 - CCS '08: Proceedings of the 15th ACM conference on Computer and communications security SP - 75 KW - browsers KW - csrf KW - login KW - security KW - web AU - Barth, Adam AU - Jackson, Collin AU - Mitchell, John PY - 2008/// UR - http://dx.doi.org/10.1145/1455770.1455782 ER -