CSRF attack Introduction and common defensive means

Source: Internet
Author: User
Tags csrf attack

What is CSRF attack.

CSRF (cross-site request forgery) is an attacker who lures a user to visit a page to perform related operations in a third party site as the user.

For example: After landing the Sohu blog, only need to request this URL, you can bar number "156713012" blog post Delete


The attacker first constructs a page in its own domain:


Content is:

When an attacker lures a target user to visit, the URL is automatically requested and the post has been deleted. As you can see, the key to CSRF attacks is to bypass user forgery requests for attacks. CSRF attack-related Basics-browser cookie Policy

There are two types of cookies that the browser holds: Session cookie (temporary cookie), Third-party cookie (local cookie). The difference is that the local cookie sets the expire time of the cookie, expires, and fails after the temporary cookie browser closes. Attack mode


Attacker constructs an attack environment, forges get/post requests, and lures users to access. such as , <iframe>, <script>, <link>, automatically send a forgery request. CSRF Defense Verification Code: the most concise and effective way to defend. The process of CSRF attacks is often the user's ignorance of the construction of the network request. The validation code, then, enforces that interaction with the application must be enforced. But not all of the operations are combined with validation code, so the most common use of scene limited Referer check  is "prevent picture hotlinking", check Referer source, only under their own domain name to pass. The disadvantage is that the server is not always able to fetch referer, such as HTTPS anti CSRF token  the industry's consistent practice is to use a Token, encrypted with cookies (MD5), because attacking a spoofed Web site does not get the cookie of the attacked site, Therefore, it is impossible to construct a complete URL to implement the CSRF attack. Use principle: Token generation must be random thinking extended q:refer is not completely credible, can forge references on CSRF attack way from zero to learn CSRF

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.