1
00:00:01,840 --> 00:00:02,930
[Autogenerated] with the knowledge we have

2
00:00:02,930 --> 00:00:05,910
now we can make a list off C. S R f Do's

3
00:00:05,910 --> 00:00:10,110
and don'ts do use some side cookies. You

4
00:00:10,110 --> 00:00:12,780
strict mode if possible. But if you need

5
00:00:12,780 --> 00:00:15,570
your side to be linked to, use lacks mode

6
00:00:15,570 --> 00:00:18,730
as a minimum. Because all the browsers

7
00:00:18,730 --> 00:00:21,670
don't support same site cookies. Consider

8
00:00:21,670 --> 00:00:24,110
not serving them at all, since they have

9
00:00:24,110 --> 00:00:26,920
many vulnerabilities. You can do that by,

10
00:00:26,920 --> 00:00:29,420
for example, writing a filter that detects

11
00:00:29,420 --> 00:00:32,130
the browser header at the time of writing.

12
00:00:32,130 --> 00:00:35,020
Only 10% of all browser users have a

13
00:00:35,020 --> 00:00:37,180
browser that doesn't support same side

14
00:00:37,180 --> 00:00:39,760
cookies. I would recommend a defense in

15
00:00:39,760 --> 00:00:42,270
depth strategy in addition to the above

16
00:00:42,270 --> 00:00:45,870
measures. Always use anti forgery tokens

17
00:00:45,870 --> 00:00:48,640
in your forms, especially since they're so

18
00:00:48,640 --> 00:00:52,430
easy to implement in a speed on that, HTML

19
00:00:52,430 --> 00:00:55,280
forms also support a get request when a

20
00:00:55,280 --> 00:00:57,810
former ship made it. Don't use that

21
00:00:57,810 --> 00:01:00,930
because C. S. R. F will work with same

22
00:01:00,930 --> 00:01:04,280
sights set to Lex, and anti forgery tokens

23
00:01:04,280 --> 00:01:07,440
are designed to work with the post. With

24
00:01:07,440 --> 00:01:09,750
all these measures in place, you must

25
00:01:09,750 --> 00:01:12,070
still think carefully about what kind of

26
00:01:12,070 --> 00:01:13,980
request your supporting in your Web

27
00:01:13,980 --> 00:01:17,040
application to see what I mean, and to

28
00:01:17,040 --> 00:01:19,190
further explore see years a ref and same

29
00:01:19,190 --> 00:01:21,830
side cookies. I'm finishing this course

30
00:01:21,830 --> 00:01:25,560
with a couple of experiments. I'm adding a

31
00:01:25,560 --> 00:01:28,070
method to my controller and let's be

32
00:01:28,070 --> 00:01:31,140
changed the favorite coffee of the user.

33
00:01:31,140 --> 00:01:34,000
It accepts the new favorite and its users

34
00:01:34,000 --> 00:01:36,310
the cookie with the loyalty number to do

35
00:01:36,310 --> 00:01:39,930
it. Let's turn off same side cookies For

36
00:01:39,930 --> 00:01:42,650
now in the coffee application, the

37
00:01:42,650 --> 00:01:45,060
Attackers can now just create a link that

38
00:01:45,060 --> 00:01:47,840
changes the favourite, inviting users to

39
00:01:47,840 --> 00:01:50,880
click on it. As you can see, it just

40
00:01:50,880 --> 00:01:55,710
works. Now we're making this even sneak

41
00:01:55,710 --> 00:01:59,600
here in the Attackers HD Mel, I'm putting

42
00:01:59,600 --> 00:02:02,750
an image stack, the source of which is a

43
00:02:02,750 --> 00:02:04,820
your L to the new method setting the

44
00:02:04,820 --> 00:02:08,810
favor. Tow attacked when I now first run

45
00:02:08,810 --> 00:02:10,760
the coffee shop application, setting the

46
00:02:10,760 --> 00:02:13,440
cookie and then run the Attackers website.

47
00:02:13,440 --> 00:02:16,210
It shows a missing image symbol. It can be

48
00:02:16,210 --> 00:02:18,050
easily masked by the attacker, too, Of

49
00:02:18,050 --> 00:02:21,220
course, when I now refresh the bait in the

50
00:02:21,220 --> 00:02:24,440
coffee shop up, my favorite is changed

51
00:02:24,440 --> 00:02:27,110
without me having to click or do anything

52
00:02:27,110 --> 00:02:29,280
on the Attackers website. Imagine an

53
00:02:29,280 --> 00:02:32,230
attack as webpage. It has thousands off

54
00:02:32,230 --> 00:02:34,680
these trying thousands off different

55
00:02:34,680 --> 00:02:38,460
websites. Now I'm turning same site

56
00:02:38,460 --> 00:02:41,590
cookies on again. We know strict will

57
00:02:41,590 --> 00:02:45,240
mitigate the attack. But let's try Lex

58
00:02:45,240 --> 00:02:47,830
when I again run the projects in order and

59
00:02:47,830 --> 00:02:50,990
refresh the page. It turns out C S. R F

60
00:02:50,990 --> 00:02:53,920
using an image doesn't work anymore. Alexe

61
00:02:53,920 --> 00:02:57,470
setting allows get requests, but not all.

62
00:02:57,470 --> 00:03:00,370
Get requests. Just get requests that

63
00:03:00,370 --> 00:03:03,630
originate from links. Let me try the link

64
00:03:03,630 --> 00:03:06,600
we created. The attack succeeds. The

65
00:03:06,600 --> 00:03:09,680
conclusion is we're not entirely home free

66
00:03:09,680 --> 00:03:13,190
with same side cookies in lex mode. As the

67
00:03:13,190 --> 00:03:15,740
final experiment, I'm adding a bit of

68
00:03:15,740 --> 00:03:18,020
JavaScript to the attacker site. There.

69
00:03:18,020 --> 00:03:20,500
Doesn't Ajax get request to the set?

70
00:03:20,500 --> 00:03:23,620
Favorite method with credentials include

71
00:03:23,620 --> 00:03:25,640
I'm configuring the request to include

72
00:03:25,640 --> 00:03:29,150
cookies to avoid confusion. I'm commenting

73
00:03:29,150 --> 00:03:31,950
out the I am D tag. When I try this, the

74
00:03:31,950 --> 00:03:34,480
Attackers website generates an error

75
00:03:34,480 --> 00:03:36,830
because regardless off the same size

76
00:03:36,830 --> 00:03:39,760
setting on the cookie cross site, Ajax

77
00:03:39,760 --> 00:03:42,600
requests are not allowed by browsers

78
00:03:42,600 --> 00:03:45,130
without a course had a present that allows

79
00:03:45,130 --> 00:03:48,370
it. So we have automatic protection here.

80
00:03:48,370 --> 00:03:50,410
There's not a course in this learning path

81
00:03:50,410 --> 00:03:53,040
that will explain course completely for

82
00:03:53,040 --> 00:03:56,080
this demo. I'm allowing cross site Ajax

83
00:03:56,080 --> 00:03:59,580
requests for all you or else something you

84
00:03:59,580 --> 00:04:02,680
should never do in a production app. I'm

85
00:04:02,680 --> 00:04:04,330
adding a line of Goto to configure

86
00:04:04,330 --> 00:04:06,700
service's method first and then to the

87
00:04:06,700 --> 00:04:10,140
configure method in the start of class.

88
00:04:10,140 --> 00:04:12,780
The attack still doesn't succeed. The

89
00:04:12,780 --> 00:04:15,070
browser will not send cookies along with

90
00:04:15,070 --> 00:04:17,820
an Ajax request when the course header is

91
00:04:17,820 --> 00:04:20,790
set to allow all sites. Since that will

92
00:04:20,790 --> 00:04:24,760
open our side for CSR af attacks, we are

93
00:04:24,760 --> 00:04:27,180
forced to be specific, which is a good

94
00:04:27,180 --> 00:04:29,350
thing because it will be hard for

95
00:04:29,350 --> 00:04:32,220
Attackers to let the attack site emit a

96
00:04:32,220 --> 00:04:36,090
course header with their domain allowed.

97
00:04:36,090 --> 00:04:38,550
It's also possible to use anti forgery

98
00:04:38,550 --> 00:04:40,940
tokens in Ajax requests by letting the

99
00:04:40,940 --> 00:04:43,710
server generate them and verify them when

100
00:04:43,710 --> 00:04:46,770
a post occurs. To see how this works,

101
00:04:46,770 --> 00:04:51,020
visit this u r l that leads us to the

102
00:04:51,020 --> 00:04:54,140
second c S r f best breakfast. This life

103
00:04:54,140 --> 00:04:56,940
do not create methods in your application.

104
00:04:56,940 --> 00:04:59,770
Responding to get requests that changed

105
00:04:59,770 --> 00:05:03,200
data application state issued use both

106
00:05:03,200 --> 00:05:06,470
requests and staff are in creating single

107
00:05:06,470 --> 00:05:09,630
page applications. Set up your FBI in a

108
00:05:09,630 --> 00:05:12,140
different domain or sub jemaine and set up

109
00:05:12,140 --> 00:05:15,720
a course using specific rules but don't

110
00:05:15,720 --> 00:05:18,220
rely on course alone. All the before

111
00:05:18,220 --> 00:05:20,630
mentioned best practices are also

112
00:05:20,630 --> 00:05:23,630
applicable to sparse. Also, just do your

113
00:05:23,630 --> 00:05:26,970
Ajax requests with the build in JavaScript

114
00:05:26,970 --> 00:05:33,000
ways to do it or use libraries that are built on top of these race.

