# CSRF in all API endpoints when authenticated using HTTP Authentication

Shopify API endpoints accepted form-encoded POSTs without CSRF tokens when the merchant was authenticated via HTTP Basic Auth, letting a malicious page create products and other resources.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2017-03-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/195156
- Library page: https://bugbountylibrary.com/r/h1%3A195156
- Tags: area:web domain:api domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:auth-bypass vuln:csrf

**Target:** Shopify Admin REST API (/admin/*.json)
**Root cause:** API endpoints accept application/x-www-form-urlencoded bodies without validating an authenticity token when the session is established via HTTP Basic Auth, and the browser auto-attaches cached Basic Auth credentials to cross-site requests.
**Steps:**
1. Create a private app in a Shopify shop and open the provided Basic Auth example URL so the browser caches the credentials.
2. From any origin, submit a form POST to `https://[shop].myshopify.com/admin/products.json` with fields `product[title]`, `product[vendor]`, `product[body_html]`, `product[product_type]`.
3. Observe the product created at `[shop].myshopify.com/admin/products`.
4. For PUT/PATCH/DELETE endpoints, submit via POST with the `_method` parameter.
**How found:** Noticed Shopify's docs hand users a Basic Auth example URL; realized browsers cache and auto-send those credentials on cross-site requests, then tested a plain HTML form against admin API endpoints.
**Exploitation:** Attacker hosts a page with an auto-submitting form targeting the victim shop's admin API; the browser attaches cached Basic Auth credentials, so the request is authenticated and the action (create product, webhook, fulfill order, edit theme) executes without a CSRF token.
**Escalation:** Any API action is reachable, including creating a webhook that exfiltrates all shop events to an attacker server.
**Insight:** When an API shares a domain with the web app and supports Basic Auth, browsers replay cached credentials on cross-origin form posts — test form-encoded bodies against JSON API endpoints that normally require tokens.