0
votes
1answer
98 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
2
votes
1answer
120 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
0
votes
1answer
404 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
2
votes
1answer
397 views

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
5
votes
2answers
705 views

CSRF protection for AJAX when using multiple browser tabs

Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
5
votes
1answer
465 views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
5
votes
4answers
958 views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
12
votes
2answers
2k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...