Cross-Site-Request-forgery-protection-in-web-applications-via-Synchroniser-Token-Patterns

What is Cross-site request forgery?

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts.

Let’s take a look at a concrete example to get a better understanding.

Assume that your bank’s website provides a form that allows transferring money from the currently logged in user to another bank account. For example, the HTTP request might look like:

POST /transfer HTTP/1.1

Host: bank.example.com
Cookie: JSESSIONID=randomid; Domain=bank.example.com; Secure; HttpOnly
Content-Type: application/x-www-form-urlencoded
amount=100.00 & routingNumber=1234&account=9876

Now pretend you authenticate to your bank’s website and then, without logging out, visit an evil website. The evil website contains an HTML page with the following form:

<input type="hidden"
 name="amount"
 value="100.00"/>
<input type="hidden"
 name="routingNumber"
 value="evilsRoutingNumber"/>
<input type="hidden"
 name="account"
 value="evilsAccountNumber"/>
<input type="submit"
 value="Win Money!"/>
</form>

You like to win money, so you click on the submit button. In the process, you have unintentionally transferred $100 to a malicious user. This happens because, while the evil website cannot see your cookies, the cookies associated with your bank are still sent along with the request.

How to use protection methods?

CSRF Protection can be implemented in two main ways,

Synchronizer Token Patterns

Double Submit Cookie Patterns

In this post we are going to show the implementation process of Synchronizer Token Patterns,

You can see a sample project (Github) :-
https://github.com/MalikDilsh/Cross-Site-Request-forgery-protection-in-web-applications-via-Synchroniser-Token-Patterns

That is an example showing how to implement a Client side and Server Side to face XSS attacks using CSRF token method (Synchronized way)

Username : malik
Password : malik123
Make sure to check the remember me Checkbox

Step 1:

First of all create a index.php (client side). Start a session and create cookie to store session id. (That will also use for validate session id with server side)

Step 2:

Then we need to generate CSRF token and store it in the server side (server.php). Because if the client side was run, we have cookies named "session id" and it containS id of the current session of client.

Step 3:

Next thing we should do is, we have to request to the server when client page is loaded and get the CSRF token stored in the server side. I created a java script function called "loadDOC". It will sends request to server side and grab CSRF token and store it in the hidden DOM field in client side when the page is loaded.

Step 4:

Call loadDOC function in client side.

Step 5:

Then we need to create hidden DOM field to store the CSRF token value. This value should send to server side again when user click to Login Button.

Step 6:

When user click Log In button, all values in the form will transfer to the server side. Next we have to validate those received values in the server side.