N/A

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.

N/A

通过时间差异性导致的信息暴露

csrf-lite 安全漏洞

csrf-lite是一个针对无框架节点网站的CSRF保护实用程序。 csrf-lite中存在安全漏洞。攻击者可利用该漏洞实施时序攻击，获取敏感信息。

N/A

N/A