Back to results
US 2011/0258704 A1Published application
Streaming insertion of tokens into content to protect against csrf
AssigneeSuccessFactors, Inc.
InventorJeffrey Ichnowski
Life of this patent
Estimating the term…
Loading patent…
Loading patent…
AssigneeSuccessFactors, Inc.
InventorJeffrey Ichnowski
Estimating the term…
Methods and apparatus are provided for protecting against cross-site request forgeries (CSRFs) by requiring certain requests submitted to a computer server to include specific tokens. The requests involve modification of or access to protected data, and the tokens are inserted by a state machine into content from which the requests are initiated. For example, content that includes a form, a hyperlink, a scripted request or other control for initiating a follow-on request to the server is modified to include tokens. The state machine may scan the content in real time (e.g., as it is served) to identify these controls and to insert the tokens. Using a state machine allows the content to be streamed even as it is scanned, does not require construction of a representation of the content (e.g., a DOM tree), and avoids modifying any of the content other than to insert one or more tokens.
A method of adding tokens to content to protect against a cross-site request forgery, the method comprising:
A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of adding tokens to content to protect against a cross-site request forgery, the method comprising:
Apparatus configured to serve content while protecting against cross-site request forgeries, the apparatus comprising:
Dependencies are inferred from the claim text.