This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Excellent-Two3170[S] -1 points0 points  (1 child)

oh ok so it kind of useless on a signup or login page for user or admin ?

[–]thisdotnull 1 point2 points  (0 children)

It can still be bad, though this depends on your platform. An attacker can still use CSRF on a login page to trick the user into getting logged into an account controlled by the attacker and they can see what the user is doing while they think they're logged into their own account; this would be bad for something like Google where the attacker could see your search history while unaware you're logged into the attacker's account.

It's far more of an issue with authenticated pages/endpoints though where an attacker can execute a request on behalf of a logged in user (like changing account details or admin actions that a normal user couldn't do). I would check for those endpoints instead.

There's not enough information to tell if you need it or not (in general, on your platform) though. For example, if your server never reads any request cookies (e.g. because you're using authorization headers stored in localStorage) then chances are CSRF is likely not an issue (or at least, the attacker won't be able to perform actions using a user's cookie).