CWE-352 on ZAP

Absence of Anti-CSRF Tokens

Mon, 01 Jan 0001 00:00:00 +0000

No Anti-CSRF tokens were found in a HTML submission form. A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

Anti-CSRF Tokens Check

Mon, 01 Jan 0001 00:00:00 +0000

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

Cross Site Request Forgery

Mon, 01 Jan 0001 00:00:00 +0000

SameSite Cookie Attribute Protection Used

Mon, 01 Jan 0001 00:00:00 +0000

Sec-Fetch-Dest Header Has an Invalid Value

Mon, 01 Jan 0001 00:00:00 +0000

Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource.

Sec-Fetch-Dest Header is Missing

Mon, 01 Jan 0001 00:00:00 +0000

Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource.

Sec-Fetch-Mode Header Has an Invalid Value

Mon, 01 Jan 0001 00:00:00 +0000

Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc.

Sec-Fetch-Mode Header is Missing

Mon, 01 Jan 0001 00:00:00 +0000

Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc.

Sec-Fetch-Site Header Has an Invalid Value

Mon, 01 Jan 0001 00:00:00 +0000

Specifies the relationship between request initiator’s origin and target’s origin.

Sec-Fetch-Site Header is Missing

Mon, 01 Jan 0001 00:00:00 +0000

Specifies the relationship between request initiator’s origin and target’s origin.

Sec-Fetch-User Header Has an Invalid Value

Mon, 01 Jan 0001 00:00:00 +0000

Specifies if a navigation request was initiated by a user.

Sec-Fetch-User Header is Missing

Mon, 01 Jan 0001 00:00:00 +0000

Specifies if a navigation request was initiated by a user.