search

OWASP / CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
https://cheatsheetseries.owasp.org
Creative Commons Attribution Share Alike 4.0 International
27.08k stars 3.79k forks source link

Update: CSRF: Also document `__Secure-` prefix for cookies against double submission attacks #1373

Closed ljrk0 closed 2 months ago

ljrk0 commented 2 months ago

What is missing or needs to be updated?

While #332 added the __Host- prefix as per the discussion in #195, the (admittedly weaker) __Secure- prefix was not added to the CSRF cheat sheet, despite being mentioned in the thread: https://github.com/OWASP/CheatSheetSeries/issues/195#issuecomment-533914778

How should this be resolved?

Arguably this prefix should be added as well, either as a recommendation for those cases were domain-locked __Host- prefixes are not possible to implement, or as a warning to check whether indeed this weakened protection is actually applicable.

jmanico commented 2 months ago

Would you care to PR this? Keep in mind this would break sites where authenticated users would need to visit different subdomains.

ljrk0 commented 2 months ago

Sure, can do! In that case, maybe we should also re-phrase the current text about __Host- which IMHO is a bit unclear:

https://github.com/OWASP/CheatSheetSeries/blob/4a8af5056f633e9d40e45c65471d88f551121832/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md?plain=1#L295

Another solution for this problem [...]

It's not completely obvious to me what "this problem" is referring to.

Additionally, I wouldn't call this as "another solution" as this sounds too much like an alternative. Especially with older clients is crucial to not see this as an alternative to existing In-Depth measures but as an extension/addition.

I'll draft something and we can iterate on that!

ljrk0 commented 2 months ago

Fixed with #1374