Lab: CSRF where token is tied to non-session cookie
Summary: This PortSwigger lab presents an email change function vulnerable to CSRF because its tokens are not fully integrated into the site's session handling system. The exercise asks the tester to host an HTML page on the exploit server that changes the viewer's email address, using two provided accounts and a URL that injects a csrfKey cookie into the victim's browser.
Key Takeaway: The lab shows that a CSRF token only defends an action if it is bound to the session, so a token tied to a separate cookie can be planted in the victim's browser and replayed against the email change function.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026