Method for prevention of cross site request forgery attack
AssigneeCPanel, Inc.
InventorJohn Lightsey
Life of this patent
Estimating the term…
Abstract
An improved method for preventing XSRF attack on a web site, which has a URL and is accessible from a port on a server. This invention: determines whether a requestor is legitimate; generates a session token for each session on the web site requested by the legitimate requestor; embeds the session token in a session cookie; additionally generates a security token; embeds the security token in the original request URL; and redirects the web site request to the newly formed URL. The subsequent request of the URL containing the security token allows the server to verify the token and serve the web site to the legitimate requestor. In other words the server's web site for that user for that session is: port/security token/URL/ form data.
Claims6
An improved method for preventing XSRF attack on a web site, said web site having a URL and being accessible from a port on a server, comprising the steps of:
- a) generating a security token for each session of said web site requested by a legitimate requestor;
- b) embedding said security token within the URL;
- c) redirecting the legitimate requestor to the URL containing the security token;
- and
- d) serving said web site to said legitimate requestor.
An improved method for preventing XSRF attack on a web site, said web site having a URL and being accessible from a port on a server, comprising the steps of requiring a requestor to furnish a security token before serving the contents of said web site;
- said security token being included in the web site address.
An improved method for preventing XSRF attack on a web site, said web site having a URL and being accessible from a port on a server, comprising the steps of:
- a) determining whether a requestor is legitimate;
- b) generating a session token for each session of said web site requested by said legitimate requestor;
- c) embedding said session token in a session cookie;
- d) communicating said session cookie to said legitimate requestor;
- e) generating a security token;
- f) rewriting the URL to contain the security token,
- g) redirecting the requestor to the newly formed URL, and
- h) serving said web site to said legitimate requestor.
Dependencies are inferred from the claim text.