Synchronizer Token Pattern

- October 04, 2018

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

Cross-site Request Forgery (CSRF) protection via Synchronizer Token Patterns

This protection technique is called as Synchronizer Token Pattern. This solution is to ensure that each request requires, in addition to our session cookie, a randomly generated token as an HTTP parameter. When a request is submitted, the server must look up the expected value for the parameter and compare it against the actual value in the request. If the values do not match, the request should fail.

Implementation

User needs to login to the website.

(username “user” password “user”)

When user clicked on "Login" button validate the user and In the background a CSRF token will be generated (token.php) using the session id.

token.php

Successful login user will be redirected to the moneyTransfer page (moneyTransfer.php)

moneyTransfer.php

Then execute an ajax call which invokes the "ajaxscriptendpoint.php" for obtain the csrf token created for the session and set it to the hidden text field's value.