Robust defenses for cross-site request forgery

TLDR

CSRF is a widely exploited vulnerability, and the newly identified login CSRF can be as severe as a cross‑site scripting flaw. The paper introduces login CSRF and evaluates existing defense techniques, proposing the Origin header as a long‑term solution. The authors analyze three major CSRF defenses, identify their shortcomings, and recommend browser support for the Origin header to balance security and privacy. Experimental data show that the Referer header is often blocked for privacy, yet it remains a reliable HTTPS‑only CSRF defense, especially against login CSRF.

Abstract

Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present a new variation on CSRF attacks, login CSRF, in which the attacker forges a cross-site request to the login form, logging the victim into the honest web site as the attacker. The severity of a login CSRF vulnerability varies by site, but it can be as severe as a cross-site scripting vulnerability. We detail three major CSRF defense techniques and find shortcomings with each technique. Although the HTTP Referer header could provide an effective defense, our experimental observation of 283,945 advertisement impressions indicates that the header is widely blocked at the network layer due to privacy concerns. Our observations do suggest, however, that the header can be used today as a reliable CSRF defense over HTTPS, making it particularly well-suited for defending against login CSRF. For the long term, we propose that browsers implement the Origin header, which provides the security benefits of the Referer header while responding to privacy concerns.