Do you need to secure your CSRF Login forms?
In general, you need to secure your login forms from CSRF attacks just as any other. Otherwise your site is vulnerable to a sort of “trusted domain phishing” attack. In short, a CSRF-vulnerable login page enables an attacker to share a user account with the victim.
Which is an example of a CSRF vulnerable login page?
In short, a CSRF-vulnerable login page enables an attacker to share a user account with the victim. As a pertinent example, consider YouTube. YouTube allowed users to see a record of “their own” viewing history, and their login form was CSRF-vulnerable!
Do you need to secure your login forms?
Yes. In general, you need to secure your login forms from CSRF attacks just as any other. Otherwise your site is vulnerable to a sort of “trusted domain phishing” attack. In short, a CSRF-vulnerable login page enables an attacker to share a user account with the victim.
How can I protect against a CSRF attack?
Any attacker attempting a CSRF attack will not be able to retrieve the CSRF token and their full login attempt will fail. The only drawback is that the user will have to manually click to complete login, which may be a clunky user experience.
What can happen with a login CSRF attack?
Login CSRF is a type of attack where the attacker can force the user to log in to the attacker’s account on a website and thus reveal information about what the user is doing while logged in. What can happen? The risk varies depending on the application and is hard to evaluate from a black-box perspective.
What’s the difference between login CSRF and public registration?
If public registration for the application exists, the risk of attacks drastically increases as it’s very easy for the attacker to create an account and thus know the credentials for it. Login CSRF is like any other CSRF, the only difference is that it occurs on the login form.
How to prevent login CSRF in OWASP code?
Remediation You need to implement a token system in your code to prevent Login CSRF – see the OWASP CSRF Prevention Cheat Sheet for different recommended methods. The important thing is to make sure the token is something the user has (but not the attacker), so that you can make sure it really is the user submitting a login request.