CSRF stands for cross-site request forgery and it can make your life as an app developer hard or easy, depending on your point of view. When it happens, you may be forced to fix the site which denied you access to your desired page or app.
CSRF was introduced as a feature in HTML5 and is now a standard. With it, developers can prevent external websites or apps from asking for information or permissions on a specific site without my permission. This is great when you take into account that most people are afraid of being tricked into giving out their personal information.
This article will talk about how to create and implement CSRF protection in your app. Now, before we get started, let’s talk about the dangers of CSRF attack.
What is a CSRF token
A CSRF token is a piece of code that websites request when you click a link or enter an email address or phone number to make something happen.
Usually, this code is installed by a web application developer and used to verify your account or prevent someone from making a purchase or Send A Message.
Why do this? Because if someone tries to buy something using an invalid email address or wrong phone number, they could be liable for paying due to verification process.
To protect yourself from this, the application developer adds the token in when developing the app. You can find it in the backend Settings page under General > Security > csrf_token.
You can also create it yourself using chrome://settings/help/csrf_token and paste it in there.
How to protect against CSRF tokens
CSRF tokens can be blocked using a whitelist or a filter, respectively. Whitelisting allows you to decide which requests are allowed to follow the token and/or restricting the scope of requests that use the token.
Use HTTPS
Unless your application needs to interact with the internet, you should switch off HTTP and on to HTTPS. This is crucial for enforcing CSRF tokens as HTTPS allows for verification of the request URL by verifying the hostname or website’s address.
This makes it more difficult for attackers to get access to your application due to intermittent error messages or invalid requests. With HTTPS, there is no chance of that!
Bullet point: Encrypt all connections
If a test fails due to an error message from the server, then try sending a new request and seeing if the new request works. If it does, then send another test!
If that still fails, then send another test and see if it gets accepted. Once you find those errors, then know that CSRF token is being used correctly.
Restrict HTTP methods
You can restrict HTTP methods in your API endpoints. For example, you might want your visitors to use a credit card to buy something, but not send payments via PayPal.
You can define which methods your API supports at config/configuration variables. For example, if your API supports paypal and pay, then the paypal method must be supported.
You can specify which ones you do and don’t support in the endpoint configuration. For example, in the endpoint for /payment/request/
Use a secret token
When you want your analytics to be secure, create a secret token and give it to your analytics. The secret token allows your analytics to interact with your site without being exposed as a customer, therefore allowing you to perform actions such as adding an attribute or completing an interaction.
This way, if somebody tries to get data from your site using this token, they would have to provide their own information which is hard to predict.
Bullet point: Use HTTPS for all connections
When you connect via internet protocol (such as a mail-merge), use secure transport services such as https:// instead of http://. Likewise, when sending data across the internet, use encrypted connections.
Check origin headers
If your attacker did something wrong, they probably bypassed authentication. That is, they could have sent a valid token to your server but it didn’t go through because the server didn’t ask for a token.
This happens a lot with online accounts that are online only occasionally. Someone might login once a week to check an item out, but since they always had to create an account to see the item, they’ve stuck with it.
To prevent this, make sure your server asks for a CSRF token when new requests are made. It is easy to do in php/mysql/sqlerb/ Caucasus-Signal-Monitoring-and-Tracking-utilities/sign_in_token.
Use CORS with preflight requests
When you need to make a request to an API that requires cross-origin requests, you can use CORS. This allows your API to communicate with another server via the request and response systems.
CORS works by identifying the origin of a request and determining if that server has permission to receive requests for your page. If it does, then it sends them a response!
Mostly, this is used when developing applications that share content or data with other websites. For example, when developing an application where users purchase products but do not yet pay for shipping, you would use CORS to test if and how the products are received by the user without leaving your site.
When requesting APIs via form submissions, make sure to include their policies regarding sharing or sending of data across sites. Many times, this is through using CORS.
Validate the origin of requests
If your application allows users to post content to your platform, then it needs to make sure that these requests are coming from the correct source.
For example, if a user posts an image to your platform, then they should be able to click a button and have the image posted directly to their account.
By checking the origin of requests, you can help validate that your app is working as expected.
Invalid CSRF tokens can indicate failure in securing your app so it is important to identify and work with them. If a token is valid, issue another one but change the email address used for validation.
If a user fails to confirm their email address or enters an invalid token, then this will prevent users from posting or accepting actions through your app.
Leave a Reply