Building in CSRF prevention #82

New Issue

Closed

opened 2019-06-10 09:49:43 +00:00 by b3yond · 0 comments

b3yond commented

2019-06-10 09:49:43 +00:00

Owner

Author: @b3yond Posted at: 27.01.2019 15:37

To prevent CSRF attacks, there is now a CSRF token at post requests which is checked against a CSRF cookie.

Even if an attacker generates a malicious form now, it will be checked against the CSRF token in the cookie, which they can't read - therefore only post requests from forms generated by the ticketfrei server will be accepted by it.

Author: @b3yond Posted at: 27.01.2019 15:37 To prevent CSRF attacks, there is now a CSRF token at post requests which is checked against a CSRF cookie. Even if an attacker generates a malicious form now, it will be checked against the CSRF token in the cookie, which they can't read - therefore only post requests from forms generated by the ticketfrei server will be accepted by it.