---
id: 524
title: "When good XSRF defence turns bad"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/when-good-xsrf-defence-turns-bad"
published_at: "2008-01-06T11:44:00Z"
tags: ["web-security", "csrf", "xsrf", "nonce", "http-redirect", "defense-bypass"]
phying_url: "https://phying.com/item/524"
lang: en
---

# When good XSRF defence turns bad

## Summary

Two-step nonce defences against XSRF fail when implemented carelessly: in one app the second step was an HTTP redirect, leaking the nonce and leaving the standard protection ineffective.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2008-01-06T11:44:00Z
- **Original:** https://portswigger.net/blog/when-good-xsrf-defence-turns-bad
- **Phying News:** https://phying.com/item/524