Providing cross site request forgery protection at an edge server

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:

• generating, by an edge server, a first token value that includes a hash value generated by hashing a secret key and one or more other values using a hash algorithm;
• including the first token value in a first cookie;
• sending the first cookie to a client device, wherein the first cookie does not include the secret key;
• modifying code of a resource that is hosted at an origin server to include a client-side script that, when executed by the client device, causes the client device to transmit a second token value as part of a request for an action to be performed on the resource;
• receiving, from the client device, the request for an action to be performed on the resource, the request including a second cookie and the second token value;
• extracting, from the second cookie, the one or more other values, and verifying a format of the second cookie matches an expected format;
• generating a third token value by hashing the secret key and the extracted one or more other values using the hash algorithm;
• comparing the first token value and the third token value to determine whether the first token value matches the third token value;
• comparing the second token value and the third token value to determine whether the second token value matches the third token value;
• and
• sending the request to the origin server in response to determining that the first token value and the second token value match the third token value.

An apparatus, comprising:

• a processor;
• a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, cause said processor to perform the following:
• generate, by an edge server, a first token value that includes a hash value generated by hashing a secret key and one or more other values using a hash algorithm;
• include the first token value in a first cookie;
• send the first cookie to a client device, wherein the first cookie does not include the secret key;
• modify code of a resource that is hosted at an origin server to include a client-side script that, when executed by the client device, causes the client device to transmit a second token value as part of a request for an action to be performed on the resource;
• receive, from the client device, the request for an action to be performed on the resource, the request including a second cookie and the second token value;
• extract, from the second cookie, the one or more other values, and verify a format of the second cookie matches an expected format;
• generate a third token value by hashing the secret key and the extracted one or more other values using the hash algorithm;
• compare the first token value and the third token value to determine whether the first token value matches the third token value;
• compare the second token value and the third token value to determine whether the second token value matches the third token value;
• and
• send the request to the origin server in response to determining that the first token value and the second token value match the third token value.