CSRF, SameSite and clickjacking
You recognise in your own app the request forgery caused by the browser sending cookies by itself and the invisible-frame trick, and close them with tokens, SameSite and framing rules.
Level 201 · 15 lessons · 13 practice labs
Lessons
How CSRF happens
- The browser sends cookies by itself: the root of CSRF
- The three conditions CSRF needs
- Recognising a CSRF-prone action with Burp
- Building a proof-of-concept page for your own app
- Short task: prove the lab app’s change-email action is open to CSRF
Defences
- The synchronizer token pattern
- Double-submit cookies and signed tokens
- SameSite: how Strict, Lax and None really behave
- Origin and Referer checks and Fetch Metadata headers
- Token flaws: checks skipped by method and tokens not tied to the session
- Short task: apply three CSRF defences and retest each one
Clickjacking and detection
- Clickjacking: the button in an invisible frame
- Protecting with frame-ancestors and X-Frame-Options
- Spotting suspicious cross-origin requests in logs
- Capstone: protect every state-changing action of an app against CSRF
Practice labs
- The email change action is open to CSRF: Prove a page on the second lab origin triggers the email change action and add a token to the action.
- An action that changes state with GET: Find a GET-based delete action that an image tag can trigger, move it to POST and protect it with a token.
- A JSON endpoint and a simple content type: Prove the CSRF in an endpoint that parses a text/plain request as JSON and add a content-type check.
- Login CSRF: Show in the lab a login CSRF that signs the victim into the attacker's account and protect the login form with a token as well.
- Apply the synchroniser token pattern: Add a session-bound token to a password change form that has none and show a request without it is refused.
- A token check skipped by method: Prove the token check runs only on POST and the same action can be done with PUT, then extend the check to every state-changing method.
- A token not bound to the session: Show one user's token is accepted in another user's session and bind the token to the session.
- The gap SameSite=Lax does not close: Prove an action thought safe under a Lax cookie is triggered by a top-level GET navigation and move it to POST alongside a token.
- A server-side filter with Fetch Metadata: Write middleware that refuses cross-site requests by Sec-Fetch headers and test that it does not break legitimate flows.
- A settings page that can be framed: Show the settings page can be framed on another origin and block it with frame-ancestors.
- Protection missing on just one page: Find the account deletion page that lacks framing protection while the rest of the site has it and connect it to the shared header.
- Seeing cross-origin requests in the log: Find suspicious cross-origin state-changing requests in the access log by Origin and Referer and report their source.
- Protect every state-changing action: List every state-changing action in the fictional Orvik Subscriptions app, add CSRF and framing protection and retest them all.
About this course
You recognise in your own app the request forgery caused by the browser sending cookies by itself and the invisible-frame trick, and close them with tokens, SameSite and framing rules.
What you will learn
- How CSRF happens
- Defences
- Clickjacking and detection
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.