> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-client-side-redirect.md).
# 通过客户端重定向绕过 SameSite Strict
### 通过客户端重定向绕过 SameSite Strict
实验室中的修改电子邮件表单存在 CSRF 漏洞。目标是通过在提供的漏洞利用服务器上托管利用代码来更改受害者的电子邮件地址。
**测试访问**/ 实验室中使用的账户： `wiener:peter`
### 主要观察
1. 电子邮件更改功能通过如下类型的 GET 请求工作：
```
/my-account/change-email?email=test@test.com&submit=1
```
通过发送这样的 JavaScript 重定向：
```javascript
```
* 如果用户未登录，页面会要求进行身份验证——当请求来自其他站点时，该查询不会携带会话 cookie。
该 `Set-Cookie` header 包含 `SameSite=Strict`，这会阻止在从其他上下文（跨站点）发起浏览时发送会话 cookie，通常会阻止经典的重定向攻击。
### 利用区域（评论 → 确认 → 重定向）
1. 有一个评论区域，然后会重定向到：
```
post/comment/confirmation?postId=8
```
确认页面上的脚本提取 `postId` 参数，并在 3 秒后重定向到相应的帖子：
```javascript
redirectOnConfirmation = (blogPath) => {
setTimeout(() => {
const url = new URL(window.location);
const postId = url.searchParams.get("postId");
window.location = blogPath + '/' + postId;
}, 3000);
}
```
```javascript
window.location = blogPath + '/' + postId;
```
```
window.location = blogPath + '/' + ../my-account;
```
观察这一行为，我们注意到 `postId` 并非绝对必须：如果修改其值（例如 `test`），重定向会到达 `.../test` ，而且似乎没有验证。
#### 通过操纵路径绕过 SameSite Strict
思路：将重定向替换为 `blogPath + '/' + postId` 替换为 `postId` ，并包含相对 `..` 段，以到达目标站点中的某个路径（回退目录），例如：
`/post/comment/confirmation?postId=../my-account`
* 然后重定向会进入更高一级目录，而不会阻止会话 cookie。
通过构造一个更具体的 `postId`，我们直接针对电子邮件更改功能：
```
/post/comment/confirmation?postId=../../my-account/change-email?email=hack@jordann.com%26submit=1
```
直接重定向到电子邮件更改页面：
```javascript
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-client-side-redirect.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.