Re: Help with referer issues in XSS
Tim <[email protected]>
| Newsgroups | gmane.comp.security.websecurity,gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
> ..., since XSS can be > used to circumvent almost any CSRF defense mechanism. Yes of course, except for certain reflected XSS bugs, since the attack vector is the same. To be clear, I definitely don't advocate any strong reliance on Referer when it comes to XSS. Injections of that type just need to be fixed properly. > Browser bugs have made methods like referrer checking, dependence on > SOP and double-submit cookies circumventable in the past. At least > with XSS defense and CSRF tokens, you have control over the defensive > mechanism and do not lean on browser security. I agree, Referer is not reliable. But it is simply obscene, from a protocol design perspective, that we have to require web developers to craft a cryptographic protocol to prevent CSRF. I mean really... It is an effective kludge, but it *is* a kludge. (Note that most developers, given the opportunity to implement any kind of crypto, will screw it up 9 times out of 10, in my experience.) At it's core, CSRF is a design flaw in the web in that no types of requests were restricted in a cross-domain sense from day one. There ought to be a way to define a policy on what domains certain requests can and cannot come from. That's the core issue with CSRF, right? If I receive a POST request from anotherapp.example.com to my app at trustedapp.example.com, that could be ok, but if the request originated from a URL in an email, that's not cool. So Referer is currently the one place you can obtain the information you need to make intelligent policy decisions about what pages can be the origin of a state-changing request. It is just too bad that Referer isn't very reliable and/or preserving of people's privacy... tim _______________________________________________ The Web Security Mailing List WebSecurity RSS Feed http://www.webappsec.org/rss/websecurity.rss Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA WASC on Twitter http://twitter.com/wascupdates [email protected] http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org