Difference between revisions of "Summit 2011 Working Sessions/Session029"

From OWASP
Jump to: navigation, search
(Mark Thomas / Apache Tomcat)
 
(2 intermediate revisions by 2 users not shown)
Line 10: Line 10:
 
| summit_session_attendee_name2 = Achim Hoffmann
 
| summit_session_attendee_name2 = Achim Hoffmann
 
| summit_session_attendee_email2 = achim@owasp.org
 
| summit_session_attendee_email2 = achim@owasp.org
| summit_session_attendee_username2 =  
+
| summit_session_attendee_username2 = Achim
 
| summit_session_attendee_company2= sic[!]sec
 
| summit_session_attendee_company2= sic[!]sec
 
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=capabilities of WAFs to protect against CSRF
 
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=capabilities of WAFs to protect against CSRF
Line 20: Line 20:
 
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=discuss how WAFs (ModSecurity) can help mitigate CSRF.  Also want to discuss/test new CSRFGuard v3 JS code
 
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=discuss how WAFs (ModSecurity) can help mitigate CSRF.  Also want to discuss/test new CSRFGuard v3 JS code
  
| summit_session_attendee_name4 =  
+
| summit_session_attendee_name4 = Mark Thomas
| summit_session_attendee_email4 =  
+
| summit_session_attendee_email4 = markt@apache.org
 
| summit_session_attendee_username4 =  
 
| summit_session_attendee_username4 =  
| summit_session_attendee_company4=
+
| summit_session_attendee_company4= Apache Software Foundation
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=
+
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=Looking for ideas to improve Apache Tomcat's built-in CSRF protection
  
 
| summit_session_attendee_name5 = Vishal Garg
 
| summit_session_attendee_name5 = Vishal Garg
Line 197: Line 197:
 
|-
 
|-
  
| summit_session_leader_name1 = Eric Sheridan
+
| summit_session_leader_name1 =  
| summit_session_leader_email1 = eric.sheridan@aspectsecurity.com
+
| summit_session_leader_email1 =  
  
 
| summit_session_leader_name2 =  
 
| summit_session_leader_name2 =  

Latest revision as of 18:25, 7 February 2011

Global Summit 2011 Home Page
Global Summit 2011 Tracks

WS. secure coding.jpg Protecting Against CSRF
Please see/use the 'discussion' page for more details about this Working Session
Working Sessions Operational Rules - Please see here the general frame of rules.
WORKING SESSION IDENTIFICATION
Short Work Session Description Examining different ways to build CSRF protection into web applications and web frameworks.
Related Projects (if any)


Email Contacts & Roles Chair


Operational Manager
Mailing list
Subscription Page
WORKING SESSION SPECIFICS
Objectives

Venue/Date&Time/Model Venue/Room
OWASP Global Summit Portugal 2011
Date & Time


Discussion Model
participants and attendees

WORKING SESSION OPERATIONAL RESOURCES
Projector, whiteboards, markers, Internet connectivity, power

WORKING SESSION ADDITIONAL DETAILS
WORKING SESSION OUTCOMES / DELIVERABLES
Proposed by Working Group Approved by OWASP Board

A practical guideline for protecting against CSRF in the real world.

After the Board Meeting - fill in here.

A concise, clear standard for determining whether an application is vulnerable to CSRF.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

After the Board Meeting - fill in here.

Working Session Participants

(Add you name by clicking "edit" on the tab on the upper left side of this page)

WORKING SESSION PARTICIPANTS
Name Company Notes & reason for participating, issues to be discussed/addressed
Chris Schmidt @
Aspect Security

Achim Hoffmann @
sic[!]sec
capabilities of WAFs to protect against CSRF
Ryan Barnett @
Trustwave's SpiderLabs
discuss how WAFs (ModSecurity) can help mitigate CSRF. Also want to discuss/test new CSRFGuard v3 JS code
Mark Thomas @
Apache Software Foundation
Looking for ideas to improve Apache Tomcat's built-in CSRF protection
Vishal Garg @
AppSecure Labs
WAFs vs. Frameworks to protect against CSRF