#1 CSRF Is A Vulnerability In All Browsers - You MUST 否定する It ASAP.
#2 最高の，を越す secret(will be published on April 1)
#3 Another Rails 問題／発行する(April 2-3)
#4 The Webkit 穴を開ける(April 2-4)
It took me a long time to understand the point behind CSR (cross-場所／位置 requests) and CRSF fully enough to find them EXTREMELY malicious.
に引き続いて points should be made before any explanation.
- It is
井戸／弁護士席known attack(yep, just like 集まり assignment). It's known but not 井戸／弁護士席. You won't find any について言及する of CSRF in 調書をとる／予約するs for beginners a la "PHP in 24 hours" or "HTML/CSS for 模造の". Underestimated 肉親，親類d of attack. - It is neither bug in OS nor in browser nor in the servers' 調整s. Linux/Mac/Windows, Chrome/Firefox/IE - it just doesn't 事柄! This is just an 推定する／予想するd 行為. And it 作品 like it supposed to. Funny, isn't it? Known since 2001 but not 直す／買収する，八百長をするd yet. 利益／興味d? Keep reading.
- HTTPS? Would not help. SSL has nothing to do with this attack.
- Short 開会／開廷／会期s? Sounds nice, but there are always a few ways to ask/軍隊 使用者 to 調印する in and than script can attack. We are human, it's not so difficult to cheat on us. And, short 開会／開廷／会期s are rare, most 場所／位置s with a "remember me" button do not rely on short 開会／開廷／会期s.
- Special plugins/拡張s to be 安全な・保証する(e.g. https://www.requestpolicy.com/). Who uses them?! O_o Almost nobody.
- 保護 on server-味方する. Rails 3 枠組み has it out-of-box - using authenticity_token helps. By the way Rails is the most 安全な・保証する 枠組み I've ever seen.(sic!) 集まり assignment is "vulnerability" in the documentation and developers are in 告発（する），告訴（する）／料金; but not in rails. At the same time to have 保護 with other langs/壇・綱領・公約s(PHP, Java, Asp.逮捕する) you have to 令状 ~10-50 付加 lines of code. IMO(and *these 事例／患者s* 証明する it) 90% of developers just don't care and don't spend time on that. That's a 抱擁する 穴を開ける, 平易な to find and 平易な to use.
The backbone.
There is site1.com. It could be anything: blog, social 網状組織 like facebook/twitter/google+ or even 支払い（額） system. You have an account on this 場所／位置.1. You are remembered with cookies 機械装置.
2. 場所／位置 has short 開会／開廷／会期s. Hacker asks you to 調印する in anyhow. E.g. the 旗，新聞一面トップの大見出し／大々的に報道する "you won 1 dollar for visiting this page, check your %支払い（額） _system%!" and in a few seconds after you 調印するd in hacker's page 解雇する／砲火／射撃s up the malicious script.
So, you are 調印するd in.
You visit 場所／位置 site2.com(with funny pictures, 解放する／自由な mp3
That 場所／位置 sells "iframe traffic"(or just 含む／封じ込めるs malicious code itself). It means that funny 場所／位置 uses your browser(and your accounts on all 場所／位置s where you are logged in!!). You know nothing and notice nothing. Hidden iframe 負担s malicious Javascript which 遂行する／発効させるs POST(or GET/DELETE/PATCH etc - all HTTP Verbs are supported) by submitting 生成するd <form> with 明確な／細部 params. Form's 活動／戦闘 points to site1.com/someaction, form's 的 - 指名する of another hidden iframe. Then, code 解雇する／砲火／射撃s up formObject.服従させる／提出する(). It is 手動式の form submitting.
What has happened? "You"(in fact "your browser") just sent request to site1.com/someaction with all needed cookies(browser 大（公）使館員d them automatically) with (definitely malicious) params - for example "spam blog 地位，任命する", "start に引き続いて another spam account" or even data for 身を引くing money to hacker's bank account(sic!) - anything.
Server 味方する has no idea that you are not "you" - it looks the same. And 使用／適用 遂行する／発効させるs your request just like it was you who made a request. You didn't notice anything.
One day you will, for example, check 名簿（に載せる）／表（にあげる） of your に引き続いてs and find there unknown strange accounts 指名するd like "viagra_buy_online_ca" or "celitra_no_prescription" lol. Or find out that few days ago you tweeted "Earn 10 Dollars Per Second 最高の Technique Blah Blah link.com/referal". (sent not 経由で twitter.com but 認可するd apps like 攻撃を受けやすい YFrog)
予防.
It is the ありふれた 事例／患者 述べるd above. Of course 場所／位置s like google, twitter, facebook etc most likely are 保護するd from this attack. But not necessary! 保護 要求するs 付加 成果／努力s - this is why so many websites are CSRF-攻撃を受けやすい.
I so much enjoy the に引き続いて 引用する from the previous shit 嵐／襲撃する:
Insecure-by-default means "insecure"正確に／まさに, the same thing here. By default your app is insecure.
If your apps 消費する requests w/o 立証するing authenticity 記念品 for each POST/GET/... request - you are 攻撃を受けやすい. For each, every time.
Yeah, you can check 'referer' every time but it 伴う／関わるs 付加 regexp/支配するs and looks so lame to me, this is not a panacea at all.
What do I 示唆する.
A 妥協. We cannot 否定する the technique 権利 away for a lot of 推論する／理由s - backwards compatibility, most 広告s and analytics engines use it - 否定 will break トンs of code in the internet, and いつかs it's really useful and needed thing etc.
Look at the pictures:
These are default 最高の，を越す 妨げる／法廷，弁護士業s in chrome and firefox for some 活動／戦闘s that could 潜在的に be malicious. I 示唆する to make a 類似の one e.g.:
*This page %hackersite.com% 服従させる／提出するs data to an 外部の 資源 %paymentsystem.com%! What to do?*
[button 受託する]
[button 拒絶する／低下する]
[check box - 追加する the 資源 domain to whitelist(for stats and 広告s)]
But it should be 否定するd by default and request should be sent only if 使用者 受託するs it.
Again, 肉親，親類d of 結論: CSRF is not a vulnerability in apps. It is a HUGE HOLE in browsers. And this damn 穴を開ける makes us, developers, to invent
We(browsers+developers+w3c etc) must find the best 解答 of the 問題／発行する and 直す／買収する，八百長をする it. 承認する, I know in before you won't listen to the speech. Words don't change the way how web browsers work. *Here are 活動／戦闘s*.
This change will 劇的な make the Internet 80%(And this is not a 無作為の number but pretty real パーセント of "攻撃を受けやすい" 場所／位置s) more 安全な・保証する and 安全な! Let's solve the 問題／発行する once and for all ASAP.
言及／関連s:
http://www.codinghorror.com/blog/2008/10/妨げるing-csrf-and-xsrf-attacks.html - in 2008 youtube had no 保護 at all. Do you still think it's newbies' mistake? Jeff Antwood SHOUTED about CSRF. What has changed since 2008? Nothing. Youtube is 安全な but thousands of new startups aren't.
https://github.com/rails/rails/blob/master/actionpack/lib/action_controller/metal/request_forgery_protection.rb - that's how rails rockstars got rid of the 問題／発行する by default.
https://マスコミ.blackhat.com/bh-eu-12/shah/bh-eu-12-Shah_HTML5_Top_10-Slides.pdf - slides from 最近の 黒人／ボイコット hat conf
http://pentestmonkey.逮捕する/blog/csrf-xml-地位，任命する-request - don't rely on custom Request Payload. The same thing with json's payloads.
https://www.owasp.org/索引.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_Referer_Header - RTFM
tbc
P.S. the first 地位，任命する 含む／封じ込めるs only theory. Please, stay tuned until April 1 and you will get
Unfortunately using cross-場所／位置 form 地位，任命するs, is really useful for 確かな types of 使用／適用s, 特に where you want a central form 運動ing (for example) several 支援する-ends which are selected by some （弁護士の）依頼人-味方する 機械装置.
Reply削除する追加するing this 肉親，親類d of "安全 panic" message to 合法的 場所／位置s, is going to make people go a bit crazy and start raising dodgy support tickets.
The problem is that doing so would break most of the 現在の "Web 2.0"/everything-as-a-service 場所／位置s.
Reply削除するI've tried Request 政策, but uninstalled it the same day because of this - most 場所／位置s routinely do トンs of 外部の requests and you can either 封鎖する everything and break features or spend トンs of time considering what to 許す and what to 否定する.
If you used an iframe instead of img, wouldn't the X-でっちあげる，人を罪に陥れる-選択s: SAMEORIGIN 封鎖する this 肉親，親類d of CSRF "attack"?
Reply削除するWhat if browsers 器具／実施するd a 肉親，親類d of hotlinking 保護 経由で http header, like X-Image-選択s: SAMEORIGIN ? This would 封鎖する your trick.
@示す no, I would feel more 安全な・保証する. It's bettter than it is now
Reply削除する@daniel. You 誇張する. Not so many 外部の requests as it seems
@f055 NO.
@Egor, could you (a)手の込んだ／(v)詳述する? you say browsers should "扱う requests and SameOriginPolicy stuff" - so why not create more sameorigin http headers (for images, forms etc.)?
Reply削除する@Egor 無視（する） my last comment, I 人物／姿／数字d out my mistake. headers get returned after the request is made, so it doesn't 事柄.
Reply削除するNice read, just 手配中の，お尋ね者 to について言及する that "sic" usually stands for "（一定の）期間ing as in 初めの": http://en.wikipedia.org/wiki/Sic
Reply削除するIf you start 開始 up "負担 3rd party content" 警告s for all cross 場所／位置 requests, there would be a lot of problems with 場所／位置s just 接近ing images, javascript, and css from third party sources.
Reply削除するA major 株 of the web uses one of the few major cdns for jquery. All of these would be counted as cross 場所／位置 requests. Should browsers 陳列する，発揮する a 警告 before 開始 all of these 場所／位置s? Definitely no.
The 解答 does not 嘘（をつく） in breaking the web from the browser, but a different angle.
wheres the beef
Reply削除する>> By the way Rails is the most 安全な・保証する 枠組み I've ever seen.
Reply削除するWhat about 解除する web 枠組み. Her e is a citation form their website: >> 解除する apps are 抵抗力のある to ありふれた vulnerabilities 含むing many of the OWASP 最高の，を越す 10
For example try to を取り引きする StackMob or Foursquare - very 利益／興味ing if you will be able to 割れ目 them too?
@Anton
Reply削除する井戸／弁護士席 tell me which 場所／位置s are written in scala with 解除する - i could give it a 発射.
In fact 解除する and rails are both 保護するd 井戸／弁護士席.
Contrary what you said, PHP's Symfony1 枠組み have had (a)自動的な／(n)自動拳銃 保護 of 集まり asigment and CSRF for ages.
Reply削除するEgor, have you manage to 侵入する StackMob or Foursquare yet?
Reply削除する@anon
Reply削除するI am learning 解除する now. So I will try it very soon, thanks
Do I also need to 保護する GET request with 記念品, or just don' ;t do modification 活動／戦闘s when using it?
Reply削除するI 設立する one 場所／位置 that use GET for everyting and relay heavyly on referer header. I seems very strange to me.
@ju
Reply削除するtwo ways. 1 . you 保護する GET with 記念品. it's ok but dirty. 2. you don't use GET for 明言する／公表する changing requests.
If 場所／位置 relies on referer try to find some 穴を開ける in 場所／位置 to send request with its referer. 挿入する < img >