# US 2016/0366172 A1 · Prevention of cross site request forgery attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366172 A1 - Document ID: US20160366172A1 - Status: Published application - Kind: A1 - Application number: 15/180,692 - Filed: 2016-06-13 - Published: 2016-12-15 - Earliest claimed: 2015-06-12 - Assignees: ARRIS Enterprises LLC - Applicants: ARRIS Enterprises LLC - Inventors: Girdhari Lal Yadav; Sabarinathan Nagarajan; Bijoy Kaippilly; Asheesh Jagdish Joshi - Web page: https://patentgrep.com/patent/US20160366172A1 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is provided for preventing cross-site request forgery (CSRF) attacks at a server that includes embedding a hidden cryptographic nonce in a response from a server to a client that is authorized to access the server. The response with the hidden cryptographic nonce is sent to the client. A subsequent request is received from the client. The subsequent request is validated or otherwise verified if it includes a hidden cryptographic nonce that matches the hidden cryptographic nonce embedded in the response from the server. ## Claims ### Claim 1 A method for preventing cross-site request forgery (CSRF) attacks at a server, comprising: embedding a hidden cryptographic nonce in a response from a server to a client that is authorized to access the server; sending the response with the hidden cryptographic nonce to the client; receiving a subsequent request from the client; and verifying if the subsequent request received from the client includes a hidden cryptographic nonce that matches the hidden cryptographic nonce embedded in the response from the server. ### Claim 2 (depends on 1) The method of claim 1, further comprising denying to process the subsequent request if the match is not verified. ### Claim 3 (depends on 1) The method of claim 1, further comprising processing the subsequent request only if the match is verified. ### Claim 4 (depends on 1) The method of claim 1, wherein the response includes a resource in which the cryptographic nonce is hidden. ### Claim 5 (depends on 4) The method of claim 4, wherein the resource is a form expressed in a markup language having fields to be populated by a user. ### Claim 6 (depends on 5) The method of claim 5, wherein the form is an HTML form. ### Claim 7 (depends on 5) The method of claim 5, wherein the verifying further comprises verifying if the subsequent request received from the client includes the form with a hidden cryptographic nonce that matches the hidden cryptographic nonce. ### Claim 8 (depends on 1) The method of claim 1, further comprising generating the hidden cryptographic nonce to be embedded in the response. ### Claim 9 (depends on 8) The method of claim 8, further comprising randomly or pseudo-randomly generating the hidden cryptographic nonce. ### Claim 10 (depends on 8) The method of claim 8, wherein the hidden cryptographic nonce that is generated is valid only during a single session between the server and the client. ### Claim 11 (depends on 1) The method of claim 1, wherein the request and the subsequent request is received from a client browser. ### Claim 12 (depends on 1) The method of claim 1, wherein sending the response with the hidden cryptographic nonce includes sending the response while the client is in a secure session with the server. ### Claim 13 At least one computer-readable storage medium encoded with instructions, which when executed by a processor, performs a method for securing against cross-site request forgery (CSRF), comprising: receiving a request from a client browser during a secure session with a server; analyzing the request to determine if a hidden cryptographic nonce is present therein and matches a previously generated cryptographic nonce previously sent to the client; and fulfilling the request only if the hidden cryptographic nonce is present therein and matches the previously generated cryptographic nonce. ### Claim 14 (depends on 13) The at least one computer-readable storage medium of claim 13, further comprising sending the previously generated cryptographic nonce during the secure session. ### Claim 15 (depends on 13) The at least one computer-readable storage medium of claim 13, wherein the request from the client includes a form previously sent to the client during the secure session, the cryptographic nonce being embedded in a hidden field of the form, the form included with the request from the client having fields populated with user specified information. ### Claim 16 (depends on 13) The at least one computer-readable storage medium of claim 13, wherein the form is expressed in a markup language. ### Claim 17 (depends on 13) The at least one computer-readable storage medium of claim 13, further comprising: receiving a second request from the client browser during a second secure session with the server after terminating the first secure session; generating a second cryptographic nonce; inserting the second cryptographic nonce into a hidden field of a resource included in a response sent by the server to the client; receiving the resource from the client in a third request from the client browser; analyzing the third request to determine if a second hidden cryptographic nonce is present therein and matches the second cryptographic nonce; and fulfilling the third request only if the second hidden cryptographic nonce is present therein and matches the second cryptographic nonce that is included in the response sent by the server to the client. ### Claim 18 (depends on 13) The at least one computer-readable storage medium of claim 13, further comprising denying to process the request if the hidden cryptographic nonce is not present in the request or does not match the previously generated cryptographic nonce. ### Claim 19 (depends on 18) The at least one computer-readable storage medium of claim 18, further comprising redirecting the client browser to a login page if the request is denied. ### Claim 20 (depends on 13) The at least one computer-readable storage medium of claim 13, wherein the hidden cryptographic nonce that is generated is valid only during a single session between the server and the client.