scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-09-09 22:31:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Address Greptile review: CSRF and CSWSH guidance

Browse source 
- Replace deprecated csurf reference with maintained CSRF patterns
- Add SameSite caveat for cross-site WebSocket hijacking tests
This commit is contained in:
Ayush7614 2026-07-04 05:36:06 +05:30
parent 84c27d2189
commit ffd15a5abb
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
strix/skills/frameworks/express.md
View file

@ -109,7 +109,7 @@ Test `<%= 7*7 %>`, `${7*7}`, `{{7*7}}` depending on engine.
### CSRF
Express has no built-in CSRF protection.
- `express-session` + cookie auth on POST/PUT/DELETE without `csurf` or double-submit token
- `express-session` + cookie auth on POST/PUT/DELETE without a maintained synchronizer-token or double-submit CSRF implementation
- `SameSite=None` cookies without proper origin checks
- CORS `credentials: true` with reflected origins

2
strix/skills/protocols/websocket.md
View file

@ -66,6 +66,8 @@ Capture legitimate client traffic; map event names (`join`, `subscribe`, `messag
Cross-Site WebSocket Hijacking: victim browser opens WS to target with victim's cookies because server doesn't validate `Origin`.
**SameSite caveat:** With `SameSite=Lax` or `Strict` session cookies, modern browsers usually withhold cookies on cross-site WebSocket handshakes — CSWSH PoCs may fail even when Origin validation is missing. Re-test with `SameSite=None` sessions and legacy clients. SameSite does not replace Origin checks for same-site subdomain attacks or token-in-query auth.
**Test:**
```html
<script>