7

I already seen some question from here (stackoverflow) and THIS post, but I still have some questions...

  1. Using hidden value in the post form and check it when post reach the server.

    • The hidden value can easy be copied and send exactly like the real one, "hard to guess" (like md5) will not help. (right?)

  2. Setting a cookie when you reach the form and send the cookie value as a hidden value.

    • You can easily change a cookie value or send a custom cookie exactly like the real one using the same real hidden value. (right?)

  3. Using 'timeout', the POST values cannot reach too late.

    • So, if you're slow you will fail when you try to set everything up with the hidden value. If you're fast it gonna work. (right?)

I want to be protected about CSRF...but how exactly I do it?

Oded
  • 489,969
  • 99
  • 883
  • 1,009
Pedro Gabriel
  • 505
  • 2
  • 11
  • 25

2 Answers2

8

The easiest way I found to prevent CSRF issues is:

  1. On the server side, assign an HttpOnly cookie to the client with a random (unguessable) token

  2. Place a hidden field on the form with that cookie value

  3. Upon form submit, ensure the hidden field value equals the cookie value (on the server side of things)

Matthew
  • 24,703
  • 9
  • 76
  • 110
  • If I send a "custom" cookie (eg: using cURL) and a value exactly as the cookie value (custom cookie got "a" and hidden value got "a" too) it gonna work (I think), send the form values as the real one. – Pedro Gabriel Jan 03 '12 at 18:36
  • 2
    That will work, but CSRF isn't to prevent people from submitting forms all together, only to prevent people form posting forms as others (ie someone with a loggin in authorized state). The whole purpose of the random token, is that user B (a hacker) does not know user A's token, and therefor cannot forge a request as them. – Matthew Jan 03 '12 at 18:43
-1

If you make the following changes then I think you're safe

  • no data updates should be allowed through GET (or better POST as well) (since both can be used through HTML forms)
  • disable CORS on your server (or at least on endpoints that are critical and/or make changes to data)
  • allow JSON-only APIs (ie. only accept input through JSON on critical endpoints at least)

Just to add to above: Do not use method overrides and do not support old browsers.

RTSid
  • 17
  • 4