Session Riding

Also Known As

TL;DR

Explanation

Session riding emphasises the mechanism of CSRF: the attacker's request piggybacks on the victim's existing browser session. Unlike session hijacking (which steals the session token), session riding leaves the token with the legitimate user — it simply abuses the browser's automatic cookie inclusion in cross-origin requests. The term is used interchangeably with CSRF in some literature. Defences are identical: SameSite cookies, synchronised CSRF tokens, and Origin/Referer header validation.

Common Misconception

Why It Matters

Common Mistakes

• No CSRF token on state-changing forms and API endpoints.
• CSRF tokens that are not rotated per session or per request.
• Same CSRF token for all users — a leaked token compromises all users.
• Not validating the CSRF token server-side — client-side validation only is bypassable.

Code Examples

// No CSRF protection — any site can submit this form on behalf of the user:
<form method="POST" action="/transfer">
    <input name="to" value="attacker">
    <input name="amount" value="1000">
</form>
// Attacker hosts: <form id='f' ...></form><script>f.submit()</script>
// Victim visits attacker page → transfer executes using victim's session

// Session riding = CSRF exploiting the session cookie

// 1. SameSite=Strict — blocks cross-site cookie submission
ini_set('session.cookie_samesite', 'Strict');

// 2. CSRF token in every state-changing form
\$_SESSION['csrf'] = bin2hex(random_bytes(32));
// <input type="hidden" name="_csrf" value="<?= \$_SESSION['csrf'] ?>">
if (!hash_equals(\$_SESSION['csrf'], \$_POST['_csrf'] ?? '')) abort(403);

// 3. Verify Origin header for AJAX
\$origin = \$_SERVER['HTTP_ORIGIN'] ?? '';
if (parse_url(\$origin, PHP_URL_HOST) !== 'yourapp.com') abort(403);

// 4. Re-authenticate for sensitive actions (transfers, email change, delete)

References

• ↗ https://owasp.org/www-community/attacks/csrf

Tags

Related Terms