Cross-site request forgery protection

A method of operating a server digital data device (“server”) comprising executing web server software within an application layer on the server,

• responding, with the web server software, to a request received over a network from a client digital data device (“client”) by (i) validating a key received from the client with that request, (ii) generating a result code indicative of a success of that validation, (iii) initiating processing of the request, including invoking server resource software executing outside the application layer,
• checking, with the server resource software, the result code upon invocation and before performing a protected operation required for processing the request,
• responding, with the server resource software, to a result code indicating that the result did not validate by exiting before executing the protected operation.

Computer instructions configured to cause

• a web server executing within an application layer on a server digital data processor (“server”) to respond to a request received from a client digital data device (“client”) over a network by (i) validating a key received from the client with that request, (ii) generating a result code indicative of a success of that validation, (iii) initiating processing of the request, including invoking server resource software executing outside the application layer,
• the server resource to (i) check the result code upon invocation before performing a protected operation required for processing the request, and (ii) respond to a result code indicating that the result did not validate by exiting before executing the protected operation.

A machine readable storage medium having stored thereon a computer program configured to cause a server digital data device (“server”) to perform the steps of:

• executing a web server within an application layer on the server to respond to a request received from a client digital data device (“client”) over a network by (i) validating a key received from the client with that request, (ii) generating a result code indicative of a success of that validation, (iii) initiating processing of the request, including invoking server resource software executing outside the application layer,
• the server resource to (i) check the result code upon invocation before performing a protected operation required for processing the request, and (ii) respond to a result code indicating that the result did not validate by exiting before executing the protected operation.