Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Lab: CSRF where token is duplicated in cookie" using Firefox

Ricardo | Last updated: Dec 08, 2022 04:32PM UTC

Hello! It seems Firefox's [Standard Enhanced Tracking Protection](https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop?as=u&utm_source=inproduct#w_standard-enhanced-tracking-protection) blocks cross-site cookies. This security mechanism prevents us from leveraging the cookie setting functionality to deliver the [Lab: CSRF where token is duplicated in cookie](https://portswigger.net/web-security/csrf/lab-token-duplicated-in-cookie) exploit. Might want to remind Web Security Academy alumni to use Chromium-based web browsers instead -- it took me a while to realize why my exploit didn't work I also noticed in [Defending against CSRF with SameSite cookies](https://portswigger.net/web-security/csrf/samesite-cookies) that > By setting the [SameSite] attribute on session cookies, an application can prevent the default browser behavior of automatically adding cookies to requests regardless of where they originate It seems the default behavior for the SameSite attribute has changed recently, such that cookies are not sent for all r

Ricardo | Last updated: Dec 08, 2022 04:36PM UTC

... such that cookies are not sent for all requests -- see [SameSite cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)

Hannah, PortSwigger Agent | Last updated: Dec 09, 2022 11:02AM UTC