csrf defenses at app sec usa

speaker: Ari Elias-Bachrach Overview Most defenses work 80% of the time. Does your app fall into the 80%? CSRF sometimes pronounced c-surf CSRF attack uses browser to perform action without user consent Vulnerable if all params predictable. Then can put url in image tag. Or use JavaScript to submit (need for post) If have multiple [...]