news.ycombinator.com• Nov 13, 2017• 1 min read
Can “Cookie to header token” CSRF prevention be beaten with permissive CORS?The CSRF Wikipedia article https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token describes Cookie-to-header_token as sending a CSRF token to users in a cookie, and then using JavaScript to read the cookie and set it as a custom header (I think a post param would work too) when making ajax calls. It also adds:The protection provided by this technique can be thwarted if the target website disables its same-origin policy using one of the following techniques: Permissive Access-Control-Allow-Origin Cross-origin resource sharing header (with asterisk argument)The article https://en.wikipedia.org/wiki/Same-origin_policy#Security_Applications also says:The user visiting the malicious site would expect that the site he or she is visiting has no access to the banking session cookie. While it is true that the JavaScript has no direct access to the banking session cookie, it could still send and receive requests to the banking site with the banking site's session cookie.
