TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Stateless CSRF Protection

42 点作者 phxql将近 12 年前

6 条评论

nbpoole将近 12 年前
&quot;Stateless&quot; CSRF protection as described here is strictly inferior to other forms of protection. The reasons are somewhat laid out in this blog post&#x27;s comments:<p>1. JavaScript in any subdomain allows a cookie to be set on unrelated subdomains. That means an attacker can set a token and override the CSRF protection entirely.<p>2. The &quot;replay protection&quot; means that you <i>must</i> continue to maintain state on the server (ostensibly to prevent duplicate requests)<p>The author has actually gone on to propose a &quot;triple submit&quot; system for CSRF protection (<a href="http://www.slideshare.net/johnwilander/stateless-anticsrf" rel="nofollow">http:&#x2F;&#x2F;www.slideshare.net&#x2F;johnwilander&#x2F;stateless-anticsrf</a>) which is still vulnerable to compromise if a related subdomain can be used to attack by setting many cookies.<p>For a more thorough discussion of CSRF mitigations, check out <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet" rel="nofollow">https:&#x2F;&#x2F;www.owasp.org&#x2F;index.php&#x2F;Cross-Site_Request_Forgery_(...</a>
评论 #5952296 未加载
评论 #5952360 未加载
kijin将近 12 年前
In general, if you have an XSS vulnerability in your app, you can&#x27;t have proper protection against CSRF, either. Every single line of JS that executes on your page should be your own, otherwise it&#x27;ll be impossible to distinguish CSRF requests from genuine requests. So there&#x27;s no point worrying about JS on your own page having access to the CSRF token. Likewise, if your pages are unencrypted, you don&#x27;t have control over anything that appears or executes on your page.<p>Provided that there are no XSS vulnerabilities (e.g. you use a framework that automatically escapes everything you put in a template) and you use SSL on all your pages, an easy way to do &quot;stateless&quot; CSRF protection is to insert a token into each form that contains encrypted information about the form and the client. For example, create an array containing a unique identifier of the form, the client&#x27;s IP address, the client&#x27;s user agent string, and any other piece of information that is available with every request (so that you don&#x27;t have to remember them). Serialize the array and encrypt it with AES using a key that you keep in the server. When you receive a POST, decrypt the token and check if the information it contains matches the client&#x27;s details. If it matches, you know that it was you who generated that token. Of course this is vulnerable to replay attacks, but if your app is XSS-proof and your pages are delivered over SSL, it should be very difficult for an attacker to obtain the token in the first place.<p>But realistically, if you&#x27;re already using cookies, there&#x27;s no point insisting on a stateless solution to anything. If your site has a login functionality at all, you&#x27;re probably already restricting dangerous actions to logged-in users only. In that case, spare a few bytes in your session storage. Generate a random token, put it in your form, and also store it in the session. Remove it from the session after use. Problem solved, and no replay attacks either. Why the obsession with stateless stuff? Maintaining state is easier than ever before. Gone are the days when sessions were incompatible with load balancing. Nowadays you can just throw all your sessions in a Redis node and access them in a fraction of a millisecond from a thousand different servers.<p>Edit: There are also in-between solutions if you really want to avoid using sessions. For example, you could keep a database of all the tokens you ever generated, from which tokens are deleted when used. This can help you prevent replays while minimizing (but not eliminating) state. If you don&#x27;t want the database to grow indefinitely, you can just say &quot;all tokens expire after X hours&quot; and periodically purge old entries from your database.
评论 #5954237 未加载
评论 #5953040 未加载
karlgoldstein将近 12 年前
What would be the flaws with this &#x27;stateless&#x27; approach:<p>1) for each new session, generate a secure random token as a property of the session<p>2) serialize session properties to a byte array and encrypt the array, using, say, AES.<p>3) set the encrypted session state as the value of the (HttpOnly) session cookie<p>4) when rendering secure pages, decrypt and include the clear CSRF token in the X-XSRF-TOKEN HTTP header (only top-level HTML pages, no other requests)<p>5) on the client, include the CSRF parameter in your XHR requests and form posts.<p>6) on the server, verify the CSRF parameter against the value in the encrypted session state from the session cookie<p>The only shared server state in this case would be the secret key used for AES; this could be part of the production environment configuration and updated with each deployment.
评论 #5953144 未加载
preinheimer将近 12 年前
I don&#x27;t understand how this works, if the client is generating the data, why can&#x27;t the CSRF attacker do the same?
评论 #5952647 未加载
评论 #5955342 未加载
DrewHintz将近 12 年前
For XHR, don&#x27;t forget the option to do stateless CSRF protection by requiring a custom HTTP header: <a href="https://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_XMLHttpRequest" rel="nofollow">https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;browsersec&#x2F;wiki&#x2F;Part2#Same-origin_...</a>
DasIch将近 12 年前
Store CSRF tokens in the session, store the session in a cookie, problem solved.