CSRF Resurrections: Starring the Unholy Trinity
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
Summary
The Premature Declaration of CSRF's Death
With browsers enforcing SameSite=Lax cookie policies by default, many developers assume that Cross-Site Request Forgery (CSRF) has been completely eradicated.
Uncovering SameSite Bypass Vectors
Dongsung Kim analyzes subtle browser behavior quirks, top-level navigation exceptions, and client-side redirects that allow attackers to bypass Lax restrictions.
Chaining the Unholy Trinity of Web Features
Kim demonstrates chaining window opening methods, service worker caches, and navigation timing bugs to reliably execute authenticated state-changing requests.
Robust Defensive Standards for Modern Web Apps
The presentation emphasizes why defense-in-depth—including custom header validation, explicit anti-CSRF tokens, and SameSite=Strict—remains indispensable.
Related talks
App Sec Village·37 min
Parsia Hakimian
Explores browser sandbox architecture and demonstrates localghost techniques for escaping client-side sandboxes.
Main Stage·42 min
James Kettle
PortSwigger head of research James Kettle unveils browser-powered desync attacks, turning victim web browsers into desynchronization weapons against major websites.
Main Stage·40 min
James Kettle
PortSwigger researcher James Kettle pioneers HTTP/2 request smuggling, uncovering critical implementation flaws when front-end reverse proxies downgrade to back-end HTTP/1.1.