> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/crsf/lab-9.md).
# Lab 9
#### The 2-minute window
Chrome auto-applies Lax to cookies that have no SameSite attribute. But to avoid breaking SSO/OAuth flows, Chrome makes an exception:
```
For the first 120 seconds after a cookie is issued
→ cross-site POST requests are allowed even under Lax
→ after 120 seconds → normal Lax rules apply
```
Instead of timing it, find something on the site that **forces the victim to get a new cookie**:
```
OAuth login flow → triggers new session cookie → 2 minute window resets
```
So the attack becomes:
```
1. Force victim through OAuth flow → fresh cookie issued
2. Immediately fire CSRF POST → within 2 minute window
3. Cookie sent → attack succeeds
```
{% hint style="info" %}
This **only works** when the site doesn't explicitly set `SameSite=Lax` — only when Chrome applied it as a default. Explicitly set Lax cookies get no grace period at all.
{% endhint %}
#### What is the Referer header
Every request your browser sends includes a `Referer` header telling the server where the request came from:
```
POST /change-email
Referer: https://bank.com/my-account
```
#### How some apps use it for CSRF defense
Instead of a CSRF token, some apps just check:
```
Did this request come from our own domain?
Referer: bank.com → allow
Referer: evil.com → block
```
***
#### Why it's weak
The Referer header can be:
**Removed entirely:**
```html
```
Request goes out with no Referer header → server gets nothing → some apps just allow it anyway.
**Spoofed/manipulated:** Some apps do lazy checking:
```
Referer contains "bank.com"? → allow
```
You can bypass with:
```
https://evil.com/bank.com/attack
```
Server sees "bank.com" in the string → allows it.
```
```
Add this to your exploit server response headers:
```
Referrer-Policy: unsafe-url
```
This forces the browser to send the **full URL including query string** as the Referer → bypass works again.