Re: [RFC DRAFT] Automatic CSRF Protection
| From: | Yasuo Ohgaki | Date: | Wed, 11 May 2016 02:18:12 +0000 |
| Subject: | Re: [RFC DRAFT] Automatic CSRF Protection | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93186@lists.php.net to get a copy of this message | ||
Hi Kinn,
On Wed, May 11, 2016 at 10:20 AM, Kinn Julião <kinncj@gmail.com> wrote:
>> JS code that does not have pages at all may obtain CSRF token manually.
>
> That's against CSRF protection... in fact, a remote app can obtain the token
> also and make the cross site request forgery...
>
> -1
You seem to __misunderstood__ behavior.
Random CSRF token generation key is stored in session data which is
private to users.
CSRF token is generated by using the secret key.
Therefore, attacker cannot get CSRF token unless they have stolen
session already (which is not scope of this RFC)
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net