Systems and methods for protecting web based applications from cross site request forgery attacks

A computer implemented method for protecting web based applications from Cross Site Request Forgery (CSRF) attacks, comprising the acts of:

• performing at least a portion of a user authentication process by obtaining authentication information from a user of a client computer and communicating said authentication information from said client computer to a server computer;
• storing an authentication-token and a CSRF protection secret received from said server computer, said authentication-token identifying a user and signifying permission to access certain resources of a plurality of first resources, and said CSRF protection secret being useful for validating a proof of possession of said CSRF protection secret contained in a first resource identifier or a first resource header for at least one resource of said plurality of first resources;
• determining which content of said plurality of first resources reference CSRF-protected resources;
• and
• modifying said content of said plurality of first resources, which was determined to reference CSRF-protected resources, to include a CSRF protected parameter that is to be validated against said CSRF protection secret included in a request for a CSRF-protected resource referenced by said content or used to generated a message included in said request.

A system configured for protecting web based applications from Cross Site Request Forgery (CSRF) attacks, comprising:

• at least one server computing device configured to:
• initialize an authentication-token subsequent to a user authentication, said authentication-token identifying a user and signifying permission to access certain resources of a plurality of first resources;
• initialize a CSRF protection secret that is to be used to validate a proof of possession of said CSRF protection secret contained in a first resource identifier or a first resource header for at least one resource of a plurality of first resources provided by a web server application;
• receive a first request for said resource, said first request including (a) said authentication-token and (b) said CSRF protection secret or a message generated using said CSRF-protected resources;
• in response to receiving said first request, determine which content of said resource references CSRF-protected resources;
• and
• modify said content of said resource, which was determined to reference CSRF-protected resources, to include a CSRF protected parameter that is to be validated against said CSRF protection secret included in a second request for a CSRF-protected resource referenced by said content or used to generate said message included in said second request.