Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update rec for CSRF Token Not Unique Per Request #436

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update rec for CSRF Token Not Unique Per Request #436

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion ..._site_request_forgery_csrf/csrf_token_not_unique_per_request/recommendations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,14 @@

A Cross-Site Request Forgery (CSRF) token should be included within all relevant requests. The CSRF token needs to be unpredictable, tied to a user's session, strictly validated before actions are executed, and not be stored within cookies.

CSRF tokens can be used to prevent CSRF attacks by making it near impossible for a malicious attacker to predict and construct a valid HTTP request of a user because they don't know the value of the CSRF token. Therefore, any request that a malicious attacker attempts to construct will not have all of the necessary parameters for the application to validate and execute the request.
Some other best practices include the following:

- Ensure that the framework is using built-in or existing CSRF prevention protections that exist within most major frameworks
- Use the `SameSite` cookie attribute, which can have the values of `Lax`, `Strict`, or `None`. For example:

``` HTTP
Set-Cookie: JSESSIONID=xxxxx; SameSite=Strict
```

For more information, please see:

Expand Down