2

I have a legacy web application and need to protect it from CSRF. I tried to resolve the issue without compromising application functionality, but I got issues related to navigation.

Can generating token and storing them in the form and session prevent the issues related to browsers back button?

Let's say I have submitted the first form in ``test1.jsp and second in test2.jsp. At this point if I try to navigate back using browsers back button and move to test1.jsp and submit the form, it will throw error as the token value from cached page and in session will be different. I tried to prevent cache storage using response headers and load the data from server on back button but the application breaks at this point.My application uses struts framework and I tried to use the struts token method but that didn't help to overcome back button issues.

Is there a way to overcome this browser back button issue using tokens?

|improve this question
3

There's no need to create a new token with each request. Instead, as per the OWASP CSRF Cheat Sheet, create a token for each session. As the same session is used for both test1.jsp and test.jsp, the back button will no longer be a problem.

|improve this answer
  • is it possible to record even the token ? in that case i think it will break the prevention mechanism, Since there is one common token in each page. @NeilSmithline – Girish Mar 26 '16 at 17:32
  • @Girish CSRF is a blind attack due to the same origin policy. The attacker can make requests but can't see the page. So the attacker can't get the token. See the OWASP reference from the question for details. – Neil Smithline Mar 27 '16 at 4:12
  • Hi @Neil Smithline ,is there any way we could use token per request without compromising back button navigation ? – Girish Jun 14 '16 at 5:09
  • @Girish perhaps, but I'm not familiar with such a technique. Why do you want to do that? – Neil Smithline Jun 14 '16 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.