Top 10 winner

CSRF: Flash + 307 redirect = Game Over

[WEB SECURITY] CSRF: Flash + 307 redirect = Game Over

Phillip Purviance · Web Application Security Consortium · 10 February 2011

A Flash file served with a permissive crossdomain.xml can set arbitrary headers and POST body, then follow a 307 redirect to the victim host; Flash keeps the attacker's policy instead of re-checking the target's, so the POST arrives with custom headers and cookies. That defeats CSRF defences that trust a custom header alone, as Rails did. Tested across Chrome, Safari and Firefox.

Record

Document

[WEB SECURITY] CSRF: Flash + 307 redirect = Game Over

Researcher

Phillip Purviance

Published by

Web Application Security Consortium

Date

10 February 2011

Topic

Other

In the archive

• Ranked #10 in the 2011 Top 10 Web Hacking Techniques

Tags

• csrf
• flash
• http
• header-injection
• sop-bypass
• rails
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Phillip Purviance, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.