Method and device for preventing CSRF attack
AssigneeInternational Business Machines Corporation
InventorsDikran S. Meliksetian, Gang Niu, Qiang Guo Tong
Life of this patent
Estimating the term…
Abstract
The disclosure provides method for preventing CSRF attacks, in which the method provides: intercepting request sent from a client browser to a server; generating a token; generating a response to the request; inserting the token into the response to the request; and sending the response to the request to the client browser with the token inserted into the response. With the method of the disclosure, it is assured that a token is inserted into all the requests made by a user through a client browser for accessing a resource. And it can be assured that the request is issued by the user himself by verifying whether the token in the request is valid, thereby preventing a CSRF attack.
Claims20
A method for preventing a Cross-Site Request Forgery (CSRF) attack, the method comprising:
- intercepting one or more requests sent from a client browser to an authentication module of a server to access a first protected resource at a first Universal Resource Locator (URL), wherein in response to receiving the one or more requests, the authentication module issues a prompt for authentication information associated with a user;
- generating a token;
- recording the token as a recorded token;
- generating a response to the one or more requests;
- inserting the recorded token into the first URL within the response to the one or more requests;
- sending the response to the one or more requests to the client browser with the recorded token inserted in the response;
- in response to sending the response to the one or more requests to the client browser and the client browser receiving the response to the one or more requests, intercepting a subsequent request that is sent from the client browser to the server, wherein the subsequent request comprises a request to access the first protected resource at the first URL;
- in response to intercepting the subsequent request:
- reading an intercepted token in the subsequent request;
- determining whether the intercepted token is valid and inserted within the address of the page corresponding to the first URL;
- and
- in response to determining the intercepted token in the subsequent request is inserted within the address of the page corresponding to the first URL and the intercepted token in the subsequent request as being valid, forwarding the subsequent request to the server;
- and
- in response to the client browser receiving the first protected resource at the first URL, intercepting a secondary request to access a second protected resource at a second URL, wherein the secondary request is initiated by selecting the second URL within a page corresponding to the first URL, wherein the secondary request to access the second protected resource at the second URL further comprises a GET request to the second URL and a referer header that contains the first URL and a secondary token inserted within the address of the page corresponding to the first URL.
Dependencies are inferred from the claim text.