Combating CSRF Attacks: A bird's-eye view - Tharindu Edirisinghe
This talk was given at the Melbourne Identity and Security Meetup on the 22nd of August 2019 (https://www.meetup.com/Melbourne-Iden...)
TALK DESCRIPTION
Cross-Site Request Forgery (CSRF) is an attack outlined in the OWASP Top 10 where a malicious website could trick a user to send unintended requests to a web application where the user is already authenticated and access the functionality in the target web application via the victim's browser. Regardless of how strong the authentication mechanisms are used in web applications, exploiting a CSRF vulnerability would lead attackers to gain access to the systems and cause severe damage. Therefore it is crucial that modern web applications should be resilient to such attacks. During this session, we will be looking at identifying CSRF vulnerabilities, exploiting them and fixing them using the proven security architectural patterns.
ABOUT THE PRESENTER
Tharindu is a PhD research scholar at La Trobe University, working on designing privacy focused software engineering processes for General Data Protection Regulation (GDPR) compliance. Prior to that he worked at WSO2, developing the open source WSO2 Identity Server product and also as a lead in the Platform Security Team. He is a co-founder of Colombo White Hat Security Meetup, the largest cyber security and IAM meetup in Sri Lanka with 1000+ participants.