Client Security-CSRF

1. Requirements

Understand and master CSRF attacks and defenses

Generation of 2.CSRF

Stealing a diagram description (http://www.cnblogs.com/hyddd/archive/2009/04/09/1432744.html)

b forged into C, a request to a to achieve the purpose of the request for forgery.

3. How to Solve

1. When processing the form data, add a flag, Csrf_token. Server-side generation, the generation method can contain timestamps and encryption, return to the client, each time the client request to take this Csrf_token, server authentication, verified before the real request to execute. (Beware of cookie hijacking caused by XSS)

2. Use the CAPTCHA image. is also a truth.

4. Solution

Solutions for the framework of reference CI

Resources:

(http://www.cnblogs.com/hyddd/archive/2009/04/09/1432744.html)

Client Security-CSRF