Show List
Tutorials > Application Security > Cross-site request forgery

Cross-site request forgery

Cross-site request forgery (CSRF) is a type of attack that involves a malicious website or application forcing a user's browser to send a request to a different website or application where the user is currently authenticated. The goal of this attack is to perform actions on behalf of the user without their consent or knowledge, such as changing their password or making unauthorized purchases.

To prevent CSRF attacks, developers often use CSRF tokens and check the referrer header of incoming requests.

A CSRF token is a random value that is generated by the server and included in the form data or URL of a page. When the user submits the form, the server verifies that the CSRF token matches the one that was originally sent. This ensures that the request was made by the user and not by a malicious third-party.

Checking the referrer header involves verifying that the request originated from the same domain as the web application. This can help prevent attackers from spoofing requests and submitting them from a different website.

Here is an example of how to implement CSRF protection using Django, a popular web application framework:

  • Generate a CSRF token in your Django view:
python
Copy code
from django.middleware.csrf import get_token
from django.http import HttpResponse

def my_view(request):
    csrf_token = get_token(request)
    return HttpResponse(f"CSRF Token: {csrf_token}")
  • Include the CSRF token in your HTML form:
php
Copy code
<form method="post">
    {% csrf_token %}
    <input type="text" name="username">
    <input type="password" name="password">
    <button type="submit">Submit</button>
</form>
  • Verify the CSRF token in your Django view before processing the form data:
python
Copy code
from django.middleware.csrf import rotate_token
from django.http import HttpResponseForbidden

def my_view(request):
    if request.method == 'POST':
        if not request.POST.get('csrfmiddlewaretoken') == request.COOKIES.get('csrftoken'):
            return HttpResponseForbidden("CSRF token mismatch")
        else:
            # Process form data
            return HttpResponse("Form submitted successfully")
    else:
        # Render form page
        rotate_token(request)
        csrf_token = get_token(request)
        return HttpResponse(f"CSRF Token: {csrf_token}")

In the example above, the csrfmiddlewaretoken field is included in the form data automatically by Django when the {% csrf_token %} template tag is used. The view checks that the token sent in the POST request matches the token stored in the user's cookies.

To check the referrer header in Django, you can use the django.middleware.csrf module's CsrfViewMiddleware middleware. This middleware checks that the Referer header of incoming requests matches the domain of the web application. You can enable this middleware by adding it to your Django settings:

python
Copy code
MIDDLEWARE = [
    # ...
    'django.middleware.csrf.CsrfViewMiddleware',
    # ...
]

In conclusion, CSRF attacks can be prevented by using CSRF tokens and checking the referrer header of incoming requests. The examples provided show how to implement CSRF protection in Django, but the same principles can be applied to other web frameworks and programming languages.



Next: Authentication and Authorization

    Leave a Comment

  • captcha text