> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-client-side-redirect.md).
# 通过客户端重定向绕过 SameSite Strict
通过客户端重定向绕过 SameSite Strict 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过客户端重定向绕过 SameSite Strict
该实验中的更改邮箱表单存在 CSRF 漏洞。目标是将漏洞利用代码托管在提供的 exploit 服务器上，从而更改受害者的电子邮箱地址。
**测试访问**/ 实验中使用的账户： `wiener:peter`
### 主要观察
1. 电子邮件更改功能通过如下类型的 GET 请求工作：
```
/my-account/change-email?email=test@test.com&submit=1
```
通过发送如下 JavaScript 重定向：
```javascript
```
* 如果用户未登录，页面会要求进行身份验证——当请求来自其他站点时，该查询不会携带会话 Cookie。
该 `Set-Cookie` 响应头包含 `SameSite=Strict`，这会阻止在从其他上下文（跨站）发起浏览时发送会话 Cookie，通常会阻止经典的重定向攻击。
### 利用区域（评论 → 确认 → 重定向）
1. 有一个评论区域，随后会重定向到：
```
post/comment/confirmation?postId=8
```
确认页面上的脚本提取 `postId` 参数，并在 3 秒后重定向到相应的帖子：
```javascript
redirectOnConfirmation = (blogPath) => {
setTimeout(() => {
const url = new URL(window.location);
const postId = url.searchParams.get("postId");
window.location = blogPath + '/' + postId;
}, 3000);
}
```
```javascript
window.location = blogPath + '/' + postId;
```
```
window.location = blogPath + '/' + ../my-account;
```
观察到这种行为后，我们注意到 `postId` 并非绝对必须：如果将其值改为（例如 `test`），重定向将指向 `.../test` ，且似乎没有进行验证。
#### 通过操纵路径绕过 SameSite Strict
思路：将重定向替换为 `blogPath + '/' + postId` 替换为 `postId` 包含相对 `..` 段，以到达目标站点中的某个路径（回退目录），例如：
`/post/comment/confirmation?postId=../my-account`
* 这样重定向就会指向上级目录，而不会阻止会话 Cookie。
通过构造一个更具体的 `postId`，我们就能直接针对电子邮件的更改功能：
```
/post/comment/confirmation?postId=../../my-account/change-email?email=hack@jordann.com%26submit=1
```
直接重定向到电子邮件更改页面：
```javascript
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-client-side-redirect.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
