Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How do you bind the value stored on the server to the logged-in user? If it's a global value (same for all users), you aren't correctly protecting against CSRF. If it's tied to the logged-in user, storing a value is essentially the same as deriving a value using HMAC (or some other one way function).


The CSRF token is generated on login and then stored in the user's session. We accept the risk of not having a per-form token for pure developer/user convenience reasons.


This is exactly what the parent suggests doing.

Keep in mind that if you don't change the client's view of the token on every page load (using some kind of salt), you are potentially vulnerable to CRIME/BEAST.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: