CSRF attack principle and nodejs implementation and defense

I. IntroductionCSRF (Cross-site Request Forgery), Chinese name: Cross-site Forgery. Attackers can steal your identity and send malicious requests in your name. For example, you can steal your account, send emails as you, and purchase items.Ii. PrinciplesThe specific schematic diagram is as follows: even more frightening is the use of tags such as img, or even the user can initiate an attack without clicking a link. For example, the following code can be added to website B: here width = 0 height = 0 indicates that the image is invisible. This statement causes the browser to send a request to another server. Whether or not the image url actually points to an image, the browser triggers this request based on the url specified in the src field. (By default, the browser does not prohibit downloading images. This is because the availability of most web programs is compromised after the image is disabled ). Loading an image does not take into account the location of the involved image (cross-origin is supported ). If website A accidentally provides the get interface, it will be very unfortunate.Iii. Attacks《CSRF attack methodsI have used examples to explain the implementation and defense methods of php. Here I will mainly talk about the implementation and defense of nodejs. For simplicity, assume that we have an application that provides two interfaces: "/get/checkvalue" and "'/post/setvalue ", they all accept a parameter "value" to change a value of the system. Of course, the premise is that the user has logged on normally. The specific logic is that it has a user login process. After successful login, the user information will be stored in the cookie, and then the cookie will be used to determine whether the access is normal. Of course, the cookie information is encrypted by md5. (Do not do this in real applications. md5 encryption is not very secure ). Service Main Program: var app = http. createServer (function (req, res) {// permission judgment authMiddle (req, res, function (err, checkValue) {if (! CheckValue) return res. end (html_login); // data query and Operation controller (req, res) ;}); user permission judgment logic: var cookieValue = crypto. createHash ('md5 '). update ('jifeng _ jifeng '). digest ('hex'); function getCookie (headers) {var cookies ={}; headers. cookie & headers. cookie. split (';'). forEach (function (cookie) {var parts = cookie. split ('='); cookies [parts [0]. trim ()] = (parts [1] | ''). trim () ;}); return cookies;} f Unction checkUser (req, res, callback) {var chunks = []; var length = 0; var rows = null; req. on ('data', function (data) {chunks. push (data); length + = data. length;}) req. on ('end', function () {var rows = new Buffer (length); var len = 0; for (var I = 0, il = chunks. length; I <il; I ++) {chunks [I]. copy (rows, len); len + = chunks [I]. length;} var args = querystring. parse (rows. toString (); if (args & Rgs. name = 'jifeng' & args. password = 'jifeng') {res. setHeader ('set-Cookie ', ['cookie1987 =' + cookieValue]); callback (null, true) ;}else {callback (null, false );}})} function authMiddle (req, res, callback) {var flag = false; var params = urllib. parse (req. url, true); if (params. pathname = '/checkuser') {return checkuser (req, res, callback);} else {var headers = req. headers; var cookies = GetCookie (headers); // obtain the user cookie if (cookies & cookies. cookie1987) {var v = cookies. cookie1987; if (v = cookieValue) {flag = true ;}} callback (null, flag) }} how to attack? The get attack page is simple. The post attack page is relatively complex. Iv. PreventionAlthough there are many methods to access csrf, in the final analysis, it is one: Increase the number of forged random numbers when the client submits the request. Nodejs in some frameworks have helped us to do this, such as reuse connect it specific implementation: http://www.bkjia.com/Article/201211/166783.html example: https://github.com/senchalabs/connect/blob/master/examples/csrf.js implementation is relatively simple, if you are interested, you can take a closer look.