Re:Hacker News CSRF Vulnerability
by lucb1e on Thursday February 25, 2016 @03:56PM
(#11177717)
Although I can totally see how this is a vulnerability, the implications are quite limited. Basically you can log people out for fun, and you can log them in to an account of yours, which I think would be noticed quite soon.
[ Parent
| on HN ]
The implications depend on your app. If the user doesn't notice being logged into a new account, they may go on to create data in the attacker's account that they expect to be private (e.g. YouTube watch history).
On e-commerce sites, they might add a credit card - thereby allowing the attacker to use it.
Fortunately, HN doesn't have these risks, but it's a good illustration of how CSRF works in the real world.
Plus if you made the account name "new" or "top posts" or something, it could take weeks for me to notice that it didn't say my username at the top right.
Good points indeed. I never thought of adding anti-CSRF measures to login forms, only while logged in, so I'll start doing that :)
Another good reason for login CSRF tokens is to prevent a malicious page from submitting lots of invalid logins and getting an account / IP locked or rate limited.