# US 12,216,763 B2 · Detecting and protecting against inconsistent use of cross-site request forgery mitigation features

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,216,763 B2
- Document ID: US12216763B2
- Status: Granted
- Kind: B2
- Application number: 17/512,563
- Filed: 2021-10-27
- Published: 2023-04-27
- Granted: 2025-02-04
- Earliest claimed: 2021-10-27
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Safwan Mahmud Khan
- Web page: https://patentgrep.com/patent/US12216763B2

## CPC

- G06F 21/575: {Secure boot}
- H04L 63/1433: {Vulnerability analysis}
- G06F 8/75: Structural analysis for program understanding
- G06F 21/31: User authentication
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- G06F 2221/033: Test or assess software
- G06F 2221/2119: Authenticating web pages, e.g. with suspicious links
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The techniques disclosed herein detect Cross-Site Request Forgery (CSRF) vulnerabilities in a web application. In some configurations, CSRF vulnerabilities are detected by analyzing the source code of the web application. Specifically, CSRF vulnerabilities are detected by determining if CSRF mitigation features of one or more frameworks are being used incorrectly or inconsistently. Some CSRF mitigation features provided by web frameworks inject capabilities into the web application, e.g. to automatically store an anti-forgery token in a cookie, copy the anti-forgery token from the cookie into an HTML, form or a request header, or determine whether form submissions or request headers include the same anti-forgery token as the cookie. CSRF vulnerabilities may be detected by analyzing the source code to identify when one of these features is omitted or used incorrectly end-to-end. CSRF vulnerabilities are also detected by identifying when CSRF mitigation features of multiple web frameworks are incompatible.

## Claims

### Claim 1

A method for detecting cross-site request forgery vulnerabilities, comprising:
receiving a source code of a web application;
opening the source code;
identifying a framework by searching for an indication of the framework in the opened source code; and
generating an indication of a cross-site request forgery vulnerability within the source code based on a determination that:
a feature of the framework is incorrectly applied to an invocation of a function within the source code, wherein the feature causes an anti-forgery token to be generated when the function is executed, and wherein the feature causes the anti-forgery token to be included in a cookie when the function is executed.

### Claim 2 (depends on 1)

The method of claim 1, wherein the source code comprises server-side source code, and wherein the function comprises an authentication function.

### Claim 3 (depends on 2)

The method of claim 2, wherein the authentication function is identified by searching the opened server-side source code for functions that receive user credentials and that return an authorization cookie comprising an authentication token.

### Claim 4 (depends on 1)

The method of claim 1, wherein the source code comprises client-side code, wherein the function comprises a web request generation function, wherein the feature ensures that a web request generated by the web request generation function includes a copy of an anti-forgery token, and wherein the determination that the feature of the framework is incorrectly applied comprises determining that the feature is not applied to the invocation of the web request generation function within the source code.

### Claim 5 (depends on 4)

The method of claim 4, wherein the feature copies the anti-forgery token from a cookie into a hidden input element of a web form that is included in the web request.

### Claim 6 (depends on 1)

The method of claim 1, wherein the source code comprises server-side source code, wherein the function comprises an authentication function, wherein the feature causes an anti-forgery token to be generated and included in a cookie when the authentication function is executed, wherein another feature verifies that the anti-forgery token is included in the cookie when a target function is executed, and wherein the determination that the feature of the framework is incorrectly applied comprises determining that the feature and the other feature use inconsistent names to reference the anti-forgery token in the cookie.

### Claim 7 (depends on 1)

The method of claim 1, wherein the indication of the cross-site request forgery vulnerability is generated based on a determination that the feature and a second feature do not use a same name when accessing an anti-forgery token in a cookie.

### Claim 8 (depends on 1)

The method of claim 1, wherein the determination is made based on a static analysis of the opened source code.

### Claim 9 (depends on 1)

The method of claim 1, wherein the feature is applied to the invocation of the function by an attribute in the source code proximate to the invocation of the function, and wherein determining that the feature is incorrectly applied to the invocation of the function includes:
searching the source code for an individual invocation of a function that receives an individual web request with a user credential and generates an individual web response that includes a cookie; and
determining that the attribute is not proximate to the individual invocation of the function.

### Claim 10

A device comprising:
one or more processors; and
a computer-readable storage medium having encoded thereon computer-executable instructions that cause the one or more processors to:
receive, with the one or more processors, a source code for a web application;
open the source code;
scan the opened source code to identify a framework used by the source code; and
generate an indication of a cross-site request forgery vulnerability within the opened source code based on a framework-based static analysis determination that:
a feature of the framework is not applied to an authentication function within the source code, wherein the feature causes an anti-forgery token to be generated when the authentication function is executed, and wherein the feature causes the anti-forgery token to be included in a cookie when the authentication function is executed.

### Claim 11 (depends on 10)

The device of claim 10, wherein the authentication function receives a user credential, authenticates the user credential, generates an anti-forgery token, and includes the generated anti-forgery token in an individual web response.

### Claim 12 (depends on 10)

The device of claim 10, wherein generating an indication of a cross-site request forgery vulnerability within the source code comprises generating a list of locations in the source code where a cross-site request forgery vulnerability is found.

### Claim 13 (depends on 10)

The device of claim 10, wherein generating an indication of a cross-site request forgery vulnerability within the source code comprises generating a list of suggested changes to the source code that mitigate the cross-site request forgery vulnerability.

### Claim 14 (depends on 10)

The device of claim 10, wherein the framework is identified based on a file extension of a file in the source code, the existence of a framework-specific file name or directory structure within the source code, or the existence of a framework-specific identifier name within the source code.

### Claim 15

A computer-readable storage media storing instructions that, when executed by a processor, cause the processor to:
receive a source code for a web application, the source code including a server-side source code and a client-side source code;
open the server-side source code;
scan the opened server-side source code to identify a framework used by the server-side source code;
open the client-side source code;
scan the opened client-side source code to identify a web framework used by the client-side source code; and
verify that the server-side source code and the client-side source code do not include a cross-site request forgery vulnerability based on a determination that:
a first feature of the framework is applied to an authentication function within the server-side source code, wherein the first feature causes an anti-forgery token to be generated and included in a cookie when the authentication function is executed,
a second feature of the web framework is correctly applied within the client-side source code, wherein the second feature causes the anti-forgery token to be copied from the cookie to an HTML form within a web response, and
a third feature of the framework is applied to a server-side function that responds to a web request that includes the HTML form, wherein the third feature verifies that the anti-forgery token included in the cookie matches the anti-forgery token included in the HTML form included in the web request.

### Claim 16 (depends on 15)

The computer-readable storage media of claim 15, wherein the determination that the first feature of the framework is applied to the authentication function includes searching a plurality of files of the opened server-side source code for the authentication function and determining that the authentication function has an attribute associated with the first feature of the framework.

### Claim 17 (depends on 16)

The computer-readable storage media of claim 16, wherein the determination that the first feature of the framework is applied to the authentication function includes searching for a base class of a class that includes the authentication function and determining that the base class has an attribute associated with the first feature of the framework.

### Claim 18 (depends on 16)

The computer-readable storage media of claim 16, wherein the determination that the first feature of the framework is applied to the authentication function includes determining that a global configuration setting enables the first feature of the framework for the authentication function.

### Claim 19 (depends on 15)

The computer-readable storage media of claim 15, wherein the web application includes a cross-site request forgery vulnerability based on a determination that the framework is incompatible with the web framework.

### Claim 20 (depends on 15)

The computer-readable storage media of claim 15, wherein the determination that the second feature of the web framework is correctly applied includes searching a plurality of files for an HTML form element that includes an individual anti-forgery token insertion attribute or a function that generates an HTML form element that is proximate to an individual anti-forgery token insertion attribute.