News for hackers. Stuff that matters.

A comment on Hacker News CSRF Vulnerability. Parent comment

Re:Hacker News CSRF Vulnerability by kogir on Thursday February 25, 2016 @07:42PM (#11179082)
wget, curl, whatever. If I'm the attacker, I ask for a new one from my server each time and put the result in the form I serve your browser.
[ Parent | on HN ]
Re:Hacker News CSRF Vulnerability by r1ch on Thursday February 25, 2016 @08:11PM (#11179209)
The CSRF token should be tied to the user session, so you'd need to perform session fixation for that to work.
[ Parent | on HN ]
Re:Hacker News CSRF Vulnerability by ubernostrum on Thursday February 25, 2016 @09:10PM (#11179407)
Tying to the session is a common practice but not necessary. You can do non-session-tied CSRF tokens so long as you don't expose your cookie.
[ Parent | on HN ]
Re:Hacker News CSRF Vulnerability by kogir on Thursday February 25, 2016 @08:52PM (#11179353)
That works if you have sessions. HN doesn't.
[ Parent | on HN ]