Dangers of CSRF Attacks and How to Prevent Them in Spring Boot App
In this KZread video, we're going to put a "hacker" hoodie and demonstrates a CSRF attack on a fake banking website to show how it works. Disclaimer - hacking or penetration testing without prior authorization is illegal.
We're going to look how to protect against CSRF attacks using two methods from Spring Security: the SameSite Attribute and the Synchronizer Token Pattern. The SameSite Attribute can prevent the browser from sending cookies for cross-site requests, while the CSRF token is a random string that the server generates and returns to the client to ensure that the request is coming from a legitimate source.
Github Repo - github.com/skr...
Docker command - docker run -p 8080:8080 -t skryvets/csrf-vulnerable-spring-application
Spring official documentation regarding CSRF - docs.spring.io...
👋🏻Connect with me:
Website: skryvets.com
Twitter: / skryvets
Github: github.com/skr...
LinkedIn: / skryvets
SUBSCRIBE TO MY CHANNEL: www.youtube.co... ❤️
Chapters
0:00 Introduction
0:28 Disclaimer
0:42 Project Intro
1:17 Project Overview
2:44 Creating the Exploit
3:27 Implementing the Solution
7:32 Solution Deep Dive: What Happened
8:31 Preventing CSRF Attacks: Overview
8:59 SameSite Attribute: Explained
12:53 CSRF Token: Explained
15:34 Types of Malicious Browsers and How Scammers Trick Users
16:39 Conclusion
Пікірлер: 21
Your videos are excellent, including the spring security as well. Please keep posting more videos like this in the future, as well.
Thanks for the video my friend. I was using csrf token, but knowing that there is another way (same-site) is great to know. Keep on going :)
It was great thank you, please keep posting ❤
Thanks many times over, actually one thing from here that helped me a lot was enabling spring security's logging in the intellij console, i had no idea there was such logging, i just assumed everything in there was all there was, though in retrospect it seems obvious. great to now be able to see everything, really nice vid bruh liked n subbed
Very super way of telling I need these type teaching
@sergey_tech
Жыл бұрын
Thank you!
It was great thank you, please keep posting
@sergey_tech
Жыл бұрын
Thank you!
Amazing video! ⭐ Thank you for the explanation. Keep posting videos you are doing a great job! 🏆 I would like to see more about Spring security and especially the hacker/dev personas (those were quite awesome and got my full attention).
Great hoodie!
@sergey_tech
Жыл бұрын
Haha, thanks 😂
Hard topic 🤯
excellent
@sergey_tech
Жыл бұрын
Thank you, Shankar 😊
like for the good explanation!!!
Is attack possible in case of SPA? If post request is made by JS code on a web page?
@sergey_tech
Жыл бұрын
The direct answer to your question is that it's 'most likely not possible'. But it depends on the authentication mechanism you're using. When most SPAs use JWT tokens, they need to be manually included in the header (typically as "Authorization: Bearer xxxx"). This method makes a CSRF attack less likely because it doesn't rely on the browser automatically sending a cookie header with a session id. However, there are two important considerations: - Ensure that the JWT token isn't stored in a cookie. - Ensure the app doesn't fall back to cookie-based authentication. These are, of course, based on my assumptions. If your app is using a session id stored in a cookie, as shown in my video, then yes, you'll need to protect against CSRF attacks.
11:14 how can a post request be a top-level request ? I thought top-level requests are the one that are made from the search bar but it's not the case for post request, is it ?
@sergey_tech
Жыл бұрын
Hey, Roronoa_D_Law! Great point! When I was referring to 'top navigation POST requests,' I was talking about POST requests that lead to a new page, such as what happens when you submit a form. This kind of POST request can indeed be considered a top-level navigation. You're correct that top-level navigation usually refers to changing the entire page, and this can occur in different ways, such as typing a URL into the address bar or clicking a link. However, it can also happen through a form submission, which typically involves a POST request. So while not all POST requests result in top-level navigation, those that do lead to a new page fall under this category. E.g. in our example, Spring app has a login form on the page "localhost:8080/login". When entering credentials it did redirect to "localhost:8080". This would be considered a top-level navigation POST request.
@roronoa_d_law1075
Жыл бұрын
@@sergey_tech oh I see, thanks for the clarification :)
how to protect from it...please make a video on it.....please sir....