Stateless prevention of login-based cross-site request forgery

A computer program product comprising computer-readable program code to be executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code including instructions to:

• receive, by a web application, a request for a login page associated with a web site;
• send, by the web application via a domain name, a response comprising the login page, a first token associated with a first function field in a request header associated with the login page, and a second token associated with a second function field in the header, the first function field being modifiable only via a related domain name that is related to the domain name;
• receive, by the web application, a request to login to the web site from a requesting client, wherein the request to login comprises a request header that comprises the first and second function fields;
• determine, by the web application, whether the first function field in the request header comprises a token that is a specific function of a token in the second function field in the request header;
• and
• establish, by the web application, a session with the requesting client in response to a determination that the first function field in the request header comprises the token which is the specific function of the token in the second function field in the request header.

A method for stateless prevention of login-based cross-site request forgery, the method comprising:

• receiving, by a web application, a request for a login page associated with a web site;
• sending, by the web application via a domain name, a response comprising the login page, a first token associated with a first function field in a request header associated with the login page and a second token associated with a second function field in the header, the first function field being modifiable only via a related domain name that is related to the domain name;
• receiving, by the web application, request to login to the web site from a requesting client, wherein the request to login comprises a request header that comprises the first and second function fields;
• determining, by the web application, whether the first function field in the request header comprises a token that is a specific function of a token in the second function field in the request header;
• and
• establishing, by the web application, a session with the requesting client in response to a determination that the first function field in the request header comprises the token which is the specific function of the token in the second function field in the request header.