labs

Our popular tags

XSS Frans Rosén Mathias Karlsson bug bounty Cross Site Scripting Chrome Hostile Subdomain takeover Ethical Hacking Slack postmessage PHP SQL Injection

Most Read Articles

How I made LastPass give me all your passwords Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token Slack bot token leakage exposing business critical information Chrome Extensions – AKA Total Absence of Privacy How Patreon got hacked – Publicly exposed Werkzeug Debugger

Analyze your website from a hacker’s perspective. Sign up for a Detectify free trial»

Stay on top of security - sign up for our newsletter

Receive monthly updates about the latest vulnerabilities, hacker attacks and security best practices.

Detectify Labs > login/logout CSRF

Login/logout CSRF: Time to reconsider?

2017.03.15 labsdetectify

My stance on login/logout CSRF has changed. I, like many others, used to quickly dismiss them as a non-security issue. However, there are several situations where they could become a security issue.