# US 2013/0160132 A1 · Cross-site request forgery protection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0160132 A1
- Document ID: US20130160132A1
- Status: Published application
- Kind: A1
- Application number: 13/325,111
- Filed: 2011-12-14
- Published: 2013-06-20
- Earliest claimed: 2011-12-14
- Inventors: POLINA GENOVA; MICHAEL ENGLER; SLAVOMIR GRIGOROV; MARIA JUROVA; BOJIDAR KADREV; MARTIN SCHMID; TSVETKO TRENDAFILOV; DIYAN YORDANOV; IWAN ZAREMBO
- Web page: https://patentgrep.com/patent/US20130160132A1

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 63/126: {the source of the received data}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Various embodiments of systems and methods for Cross-Site Request Forgery (XSRF) protection are described herein. An XSRF protection framework provides rich configuration possibilities for protection using an XSRF token. In one aspect—XSRF encoding is performed for a set of URLs according to a configuration and then a token validation is performed for incoming requests to protected resources. In another aspect—XSRF token leakage via the referrer header to external URLs is prevented.

## Claims

### Claim 1

A computer implemented method for Cross-Site Request Forgery (XSRF) protection, comprising:
receiving a configuration for an XSRF protection framework at a server computer, the XSRF protection framework used by one or more web applications residing at the server computer;
encoding an XSRF token valid for a lifecycle of a user session by adding a secure identifier to uniform resource locators (URLs) of the one or more web applications residing at the server computer; and
validating the XSRF token, when processing a request to a protected URL in the user session.

### Claim 2 (depends on 1)

The method of claim 1, wherein the configuration comprises a set of protected uniform resource locators (URLs).

### Claim 3 (depends on 2)

The method of claim 2, wherein the configuration comprises defining a Hypertext Transfer Protocol (HTTP) method for the set of protected URLs.

### Claim 4 (depends on 1)

The method of claim 1, wherein the configuration comprises a rule to exclude the XSRF protection for a set of unprotected URLs.

### Claim 5 (depends on 1)

The method of claim 1, wherein the configuration comprises a rule to prevent an XSRF token leakage through a referrer header field of the request, while processing the request to external URLs.

### Claim 6 (depends on 1)

The method of claim 1, wherein validating the XSRF token is performed based on a server managed validation.

### Claim 7 (depends on 1)

The method of claim 1, wherein validating the XSRF token is performed based on an application managed validation.

### Claim 8

A computer system for Cross-Site Request Forgery (XSRF) protection comprising:
a server computer having a processor; and
a memory in communication with the processor, the memory storing instructions related to:
a configurator module to configure an XSRF protection framework at the server computer, the XSRF protection framework used by one or more web applications residing at the server computer;
an encoder module to encode an XSRF token valid for a lifecycle of a user session by adding a secure identifier to uniform resource locators (URLs) of the one or more web applications residing at the server computer; and
a validator module to validate the XSRF token, when processing a request to a protected URL in the user session.

### Claim 9 (depends on 8)

The system of claim 8 wherein the configurator module is further operable to:
predefine a set of protected URLs; and
define an HTTP method for the set of protected URLs.

### Claim 10 (depends on 8)

The system of claim 8, wherein the configurator module is further operable to configure a rule to exclude the XSRF protection for a set of unprotected URLs.

### Claim 11 (depends on 8)

The system of claim 8, further comprising a preventor module to configure a rule to prevent an XSRF token leakage through a referrer header field of the request while processing the request to external URLs.

### Claim 12 (depends on 8)

The system of claim 8, wherein the validator module is further operable to validate the XSRF token based on a server based validation.

### Claim 13 (depends on 8)

The system of claim 8, wherein the validator module is further operable to validate the XSRF token based on an application based validation.

### Claim 14

An article of manufacture including a non-transitory computer readable storage medium to tangibly store instructions, which when executed by a computer, cause the computer to:
receive a configuration for an XSRF protection framework at a server computer, the XSRF protection framework used by one or more web applications residing at the server computer;
encode an XSRF token valid for a lifecycle of a user session by adding a secure identifier to uniform resource locators (URLs) of the one or more web applications residing at the server computer; and
validate the XSRF token, when processing a request to a protected URL in the user session.

### Claim 15 (depends on 14)

The article of manufacture of claim 14, wherein the configuration comprises a set of protected URLs.

### Claim 16 (depends on 15)

The article of manufacture of claim 15, wherein the configuration comprises an HTTP method for the set of protected URLs.

### Claim 17 (depends on 14)

The article of manufacture of claim 14, wherein the configuration comprises a rule to exclude the XSRF protection for a set of unprotected URLs.

### Claim 18 (depends on 14)

The article of manufacture of claim 14, wherein the configuration comprises a rule to prevent an XSRF token leakage through a referrer header field of the request, while processing the request to external URLs.

### Claim 19 (depends on 14)

The article of manufacture of claim 14, wherein the instructions to validate the XSRF token further comprise instructions, which when executed by a computer, cause the computer to validate the token based on a server managed validation.

### Claim 20 (depends on 14)

The article of manufacture of claim 14, wherein the instructions to validate the XSRF token further comprise instructions, which when executed by a computer, cause the computer to validate the token based on an application managed validation.