0

Need some inputs for the CSRF token design to prevent anti-automation. 1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part of the Get Response of Page Load. The idea is to provide a solution, where no major state is stored on the server-except for one token for each user session per request.

Every time, a request is made( Get/Post), the existing token is validate and a new token is returned from the server to the client. This is stored in the user session. On sending the post request, client validates whether the token value is equal to value in the session and server validates, whether the token received in the request is same as the token stored in the session.

  1. When the user performs an action, there can be multiple requests to the server at a point of time from the client side. Or before the earlier request's response is received , there can be another request send from the client application. In this case , would the same CSRF token be send? Or should a pool of tokens be returned from the server for the same?

  2. Can this token's also be used for Get requests so as to prevent the attacker to not clog the server with replay attacks with the get requests?

  3. Also, should the CSRF token send in the header or body?

  4. Is there any need for it to be encrypted?
0

Generally CSRF-Token is used only when the state change request is made by user. State change means when user perform some CURD Operation on Application.

It’s not required to gives bunch of CSRF-token to every form in multistage form. But generally Programmer gives to every single form. Whether that Form is contain any state change action or not

We generally not recommended to use CSRF-token in get request because of GET request logged at multiple places (Logs, Load-Balancer etc.) so it creates risk for your Application .

Questions:

1) For Updating operation, there are multiple requests send to different modules on the Server. should the CSRF be same or different?

Ans : You can use the same CSRF-token issue one token for each user-session. If your application is perform critical operation than you can go for one token for each form.

2) Before a response is received, the screen is allowing user to initiate one more request? what should the CSRF token be send? The assumption is that, once the CSRF token is validated, then a new token is generated and send in the response.

Ans:if your application uses the multiple token for a single form of action, then you need to validated that token in each request and in response new token will be given to the user. But generally we haven't recommended these kind of complex implementation. if it is not that much critical application

3) CSRF should be send in header or body? Should It be encrypted?

Ans:Always in the body not in cookie. There is no need to do encryption on CSRF-Token. It is nothing but a Secure random generated string for validating that the action is intended by that user or not.

For More Details

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

  • Appreciate your response for the same. – Smitha Kutty Jan 2 at 10:18
  • Appreciate your response for the same. Just for more clarity for my question, for the following scenarios, what value should the CSRF token have? 1. For Updating operation, there are multiple requests send to different modules on the Server. should the CSRF be same or different? . 2. Before a response is received, the screen is allowing user to initiate one more request? what should the CSRF token be send? The assumption is that, once the CSRF token is validated, then a new token is generated and send in the response. Also, CSRF should be send in header or body? Should It be encrypted? – Smitha Kutty Jan 2 at 10:28
  • Thanks a lot for the same and for your point to point inputs. However, the concern I see here is , if there is one CSRF token per session and not encrypted, hacker in middle man attack and use the same token and log a request to the application and forge replay attack. 2.Also, if we should not use the same for Get requests, isn't there a possibility that the attacker can clog the system with multiple get requests and bring down the system. How do we ensure that replay attack is prevented for get requests, if not CSRF way? – Smitha Kutty Jan 3 at 4:35
  • Also sir, as I understand, if the token is kept for the whole session, it is not deleted and a new token is not returned. A new token is send in the response, only when a new session is spawned - for user login etc or refreshing the browser etc. kindly correct. – Smitha Kutty Jan 3 at 6:57
  • @Jiya Whenever users logins-in the token will assign to that user and remains same until session got expired or logout event is fired.after login again new token is assigned to that user.If answer is usual for you than you can vote for my answer – Zodiac070495 Jan 3 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.