When good XSRF defence turns bad
Summary: PortSwigger Research describes an application that had been full of cross-site request forgery flaws and was reimplemented with two-step nonce issuance and validation, but the second step was delivered as an HTTP redirect. Because the browser follows the redirect and resubmits the nonce with the session cookie regardless of where the first request originated, the defence achieves nothing and the development time was wasted.
Key Takeaway: The same origin policy that developers count on to block an attacker from reading the bank's response is irrelevant here, because the attacker never needs to read the nonce - it only needs the victim's browser to follow the redirect. A nonce defence only holds when the resubmission comes from an informed user interaction, such as a confirm button on a page the attacker's code cannot read.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026