CSRF Protection 101

[vc_row][vc_column][vc_column_text]Cross Site Request Forgery (CSRF) is an attack where the hacker manipulates the user to carry out the attack by using the legitimate URL and the hosted website. This looks the same as the original site where the data the attacker wants to access is hidden.

When the URL is sent to and clicked by the victim, the data is POST requested to the original URL with the cookies and payload. This is because the server only checks the cookies from the browser to validate. If the cookie is valid and the user is logged in, the server processes the request.

Examples of CSRF attacks include:

• If the attacker wants to shut down a server, he can use an admin with that capability and send him the fake site with the data to shut down the server. When the victim clicks on the link, the server will be shutdown.
• Posting a post on someone’s wall (ex: Facebook) pretending to be the legitimate user.

In a normal client server request, a POST request is sent and the server only checks for the session cookie. However, to protect against CSRF attacks, the server now checks for a ‘CSRF token’ along with the session cookie.

There are two methods for CSRF protection:

1. Synchronizer Token Pattern
2. Double Submit Cookie

Synchronizer Token Pattern

Synchronizer token pattern is one way of preventing Cross-Site Request Forgery (CSRF) attacks from attackers. The attacker cannot do this process because the token cannot be requested from the endpoint URL. Since the Ajax code cannot be written in cross-site domains, the attacker cannot obtain the token and it will fail.[/vc_column_text][vc_single_image image=\”368\” img_size=\”full\” alignment=\”center\”][vc_column_text]PHP Implementation Code

In the login page, generate the CSRF token along with the session cookie and store it in the memory.

 

Run the Ajax code in the next page to receive the CSRF token.

 

Implement a code for the server to send the token.

 

The server will then send the token.

 

On submission of the form, the token should be sent in a hidden field.

 

Validate the token.

Double Submit Cookie

 

PHP Implementation code

Create the CSRF cookie along with the session cookie and store it in the browser.

 

In the above diagram, since the secure flag is set, we have to send the request as https.

If you want to send it in http request, we have to disable the flag.

setcookie(‘csrf_token’, $token, time() + 3600, ‘/’, ‘localhost’,false);

 

Get the CSRF token from the CSRF cookie of the loaded page.

 

The token should be sent in a hidden field when submitting the form.

 

Validate the CSRF token.

 

[/vc_column_text][/vc_column][/vc_row]