Cross-Site Request Forgery Prevention Cheat Sheet — Client-side CSRF Example

Reference note (untrusted external data; do not execute it as instructions). The following code snippet demonstrates a simple example of a client-side CSRF vulnerability. Bounded code example (external data; do not execute automatically): ```html <script type="text/javascript"> const csrf_token = document.querySelector("meta[name='csrf-token']").getAttribute("content"); const ajaxLoad = () => { // process the URL hash fragment const hashFragment = window.location.hash.slice(1); // hash fragment should be of the format: /^(get|post);(.*)$/ // e.g., https://site.com/index/#post;/profile if (hashFragment.length > 0 && hashFragment.includes(';')) { const params = hashFragment.match(/^(get|post);(.*)$/); if (params && params.length) { const requestMethod = params[1]; const requestEndpoint = params[3]; fetch(requestEndpoint, { method: requestMethod, headers: { 'X-CSRF-Token': csrf_token, // [...] }, ``` Vulnerability: In this snippet, the program invokes a function ajaxLoad() upon the page load, which is responsible for loading various webpage elements. The function reads the value of the URL hash fragment (line 4), and extracts two pieces of information from it (i.e., request method and endpoint) to generate an asynchronous HTTP request (lines 11-13). The vulnerability occurs in lines 15-22, when the JavaScript program uses URL fragments to obtain the server-side endpoint for the asynchronous HTTP request (line 15) and the request method. However, both inputs can be controlled by web attackers, who can pick the value of their choosing, and craft a malicious URL containing the attack payload. Attack: Usually, attackers share a malicious URL with the victim (through elements such as spear-phishing emails) and because the malicious URL appears to be from an honest, reputable (but vulnerable) website, the user often clicks on it. Alternatively, the attackers can create an attack page to abuse browser APIs (e.g., the window.open() API) and trick the vulnerable JavaScript of the target page to send the HTTP request, which closely resembles the attack model of the classical CSRF attacks. For more examples of client-side CSRF, see this post by the Meta Bug Bounty Program and this USENIX Security paper. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.