Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:93247 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 84790 invoked from network); 11 May 2016 18:39:22 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 11 May 2016 18:39:22 -0000 Authentication-Results: pb1.pair.com smtp.mail=narf@devilix.net; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=narf@devilix.net; sender-id=pass Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.44 as permitted sender) X-PHP-List-Original-Sender: narf@devilix.net X-Host-Fingerprint: 209.85.218.44 mail-oi0-f44.google.com Received: from [209.85.218.44] ([209.85.218.44:36336] helo=mail-oi0-f44.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 54/B0-28272-95C73375 for ; Wed, 11 May 2016 14:39:22 -0400 Received: by mail-oi0-f44.google.com with SMTP id x201so82572413oif.3 for ; Wed, 11 May 2016 11:39:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=devilix.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=5FUuTjqE1DD4rWoahGwbs2lHRBHUm2NXBFug3nang/Q=; b=QgXOcTGo5Zw+V3YthjJ41N9a2C4J2FxlUAjNlUxnT40bVgO19EUo4p8z2Bg4j3EplV Cvi6QdapihtDsZw3lmvY0W8UBv/y5c/nO9O00AHQSjPUxEzoK/2PznjjnWa5szxZpv51 K9bVUHRmdFF9pPywfwlo5l/sC3K82SnSwl8Ek= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=5FUuTjqE1DD4rWoahGwbs2lHRBHUm2NXBFug3nang/Q=; b=OjLj5NczsFnhEvwLX1i4ihihWuzzG8xIeQ5a1g8uDPexa/mjk8CFkotop5Mr8RDaUk AcapkeCyZoslk4f6PqWx3QjLicwKGXvX90Z1vLDWyZWGNtBrYh0h51DcYhIi9FD02VNV 6TSgv4fgm/ghVu0KopVVIOypMU+ZyEwqG/RuF9qMZAEwtXRDZxnpe3olsECk+6MyXfwj UMewYGogSlGM6Y/bpyksYrIn5Z1q7xMk5mKjnNhH2Xackjw0NSCftstzMf1HjEEyFSBI 1by4mLuW/G38uAj827eznS3xXA+dvrJDxwUTWCh9CCuCYqJyLt7Ir1L+hbQpB1EkOeds akAA== X-Gm-Message-State: AOPr4FVg+r8xXkMZqfL2Pzjz70uiw0A5MCJTtvQtH2cBTSgYqhijYnoc2L3nW3by0AeRZ5h8FJX4IEFZa9XWow== MIME-Version: 1.0 X-Received: by 10.157.63.70 with SMTP id m64mr3085037otc.170.1462991959188; Wed, 11 May 2016 11:39:19 -0700 (PDT) Received: by 10.202.175.147 with HTTP; Wed, 11 May 2016 11:39:18 -0700 (PDT) In-Reply-To: References: <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com> <4667bb84-4401-4dd6-6193-fcf3aa6b3d48@gmail.com> <4d97846f-81d6-6cad-91ad-5e513a709e91@gmail.com> <573345AF.9020206@lsces.co.uk> Date: Wed, 11 May 2016 21:39:18 +0300 Message-ID: To: Niklas Keller Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a11472f2e099d830532955cf7 Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection From: narf@devilix.net (Andrey Andreev) --001a11472f2e099d830532955cf7 Content-Type: text/plain; charset=UTF-8 On Wed, May 11, 2016 at 7:16 PM, Niklas Keller wrote: > > 2016-05-11 17:41 GMT+02:00 Andrey Andreev : > >> >> Your login form too needs CSRF protection. It's a chicken and egg problem. >> > > Not really. As long as you don't have the credentials. > You can't make any requests as the authenticated user, as there is no > authenticated user. > > Riding an authenticated user's session is the obvious, and indeed most serious CSRF attack, but not the only one ... An attacker-chosen account could be leveraged for phishing, and depending on the functionality of the website - possibly also XSS, malicious software distribution, who knows what else. Cheers, Andrey. --001a11472f2e099d830532955cf7--