I described a CSRF scenario in http://lists.w3.org/Archives/Public/public-appformats/2008Jan/0072.html. Search for the word "attack". My example attack vector depends on cookies being sent as part of the cross-site request and assumes that the simplicity of using Access Control would result is widespread adoption by a new generation of unsophisticated web service developers who will open up their APIs to mashup applications without understanding the consequences. Note that the big CSRF worry here is that cookies are sent with the requests.
Arthur Barstow
<[EMAIL PROTECTED]
a.com> To
Sent by: ext Mark Nottingham
public-appformats <[EMAIL PROTECTED]>
[EMAIL PROTECTED] cc
"WAF WG (public)"
<[email protected]>
01/15/2008 05:20 Subject
AM Re: ISSUE 19: Requirements and
Usage Scenarios document
Mark,
On Jan 14, 2008, at 11:24 PM, ext Mark Nottingham wrote:
>
> On 09/01/2008, at 1:36 PM, Jon Ferraiolo wrote:
>>
>> One thing that strikes me immediately is that there are
>> requirements about XSS (cross-site scripting) but no mention of
>> CSRF, which is one of the concern areas from the folks at OpenAjax
>> Alliance, primarliy due to the current specification saying that
>> cookies will be sent.
>>
> +1
>
> From what I understand, the response to this concern is usually
> "that horse has already bolted."
>
> For the record, while I understand this sentiment, I personally
> don't think it's a good excuse to open the door wider.
Where is the data/analysis that clearly backs your claim (that AC4CSR
introduces new attack vectors)? My apologies if I missed this (but
please do send me the pointer(s)).
Thanks, Art Barstow
---
<<inline: graycol.gif>>
<<inline: pic24327.gif>>
<<inline: ecblank.gif>>
