https://minkukjo.github.io/cs/2020/08/15/Security-1/

https://michaelzanggl.com/articles/csrf-tokens-for-spas/

csurf package는 deprecated.

https://michaelzanggl.com/articles/web-security-cors-csrf-samesite/

→ csrf 공격은 Content-Type: multipart/form-data 일때, preflight 요청이 가지 않고, 그래서 SOP가 아닌 경우에도 cookie를 담아서 요청이 들어가기 때문에, 이 방식을 사용한 공격이다.

CSRF tokens are bound to the users' session

→ csrf 토큰은 user의 session 기반으로 만들어져야 한다. 페이지가 새로고침 될때마다 토큰은 재발급됨.

🤔 Do we still need CSRF tokens with SameSite=Lax/Strict?

It depends. SameSite is a rather new feature and is not in legacy browsers or even older versions of modern browsers. If you can allow it, block the use of legacy browsers for your website.

레거시 브라우저를 안쓰면 해결?

• The cookie attribute SameSite=Lax prevents cookies being sent in a third-party context (both AJAX requests and top-level navigation POST requests) making CSRF tokens obsolete

클릭재킹

→ iframe을 안보이게 넣고, 버튼을 클릭하게 해서 요청을 보내는 방식.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

• Clickjacking is an attack that tricks people into unwantedly clicking on a site inside an (invisible) iframe
• You can prevent your site from being embeddable via iframes by setting the header "X-Frame-Options" to "DENY"