CSRF Guard - Revision history

KirstenS: Redirecting to Category:OWASP CSRFGuard Project

2008-10-10T12:55:14Z

Redirecting to Category:OWASP CSRFGuard Project

KirstenS: Redirecting to Category:OWASP CSRFGuard Project

2008-10-10T12:54:42Z

Redirecting to Category:OWASP CSRFGuard Project

KirstenS: Redirecting to Category:OWASP CSRFGuard Project

2008-09-18T15:28:03Z

Redirecting to Category:OWASP CSRFGuard Project

Esheridan: Redirecting to Category:OWASP CSRFGuard Project

2007-11-19T04:50:59Z

Redirecting to Category:OWASP CSRFGuard Project

Jaxley at 04:47, 19 November 2007

2007-11-19T04:47:04Z

Jaxley: /* Download */

2007-11-19T00:50:07Z

‎Download

Jaxley at 23:46, 16 November 2007

2007-11-16T23:46:19Z

Esheridan: /* Implementation */

2007-10-25T19:49:41Z

‎Implementation

Agocke: /* Overview */

2007-06-27T16:41:40Z

‎Overview

Agocke: /* References */

2007-06-27T16:40:32Z

‎References

← Older revision		Revision as of 12:55, 10 October 2008
Line 303:		Line 303:
	:* http://shiflett.org/articles/foiling-cross-site-attacks		:* http://shiflett.org/articles/foiling-cross-site-attacks
	:* http://java.sun.com/j2se/1.4.2/docs/api/java/security/SecureRandom.html		:* http://java.sun.com/j2se/1.4.2/docs/api/java/security/SecureRandom.html
−
−	~~[[Category:OWASP_CSRFGuard_Project]]~~
−	~~[[Category:OWASP_Validation_Project]]~~
−	~~[[Category:Control]]~~
−	~~[[Category:Java]]~~

@@ Line 306: / Line 306: @@
 [[Category:OWASP_CSRFGuard_Project]]
 [[Category:OWASP_Validation_Project]]
-[[Category:Countermeasure]]
+[[Category:Control]]
 [[Category:Java]]

@@ Line 3: / Line 3: @@
 ==Overview==
-Just when developers are starting to run in circles over [[Cross Site Scripting]], the [http://www.darkreading.com/document.asp?doc_id=107651&WT.svl=news1_2 'sleeping giant'] awakes for yet another web-catastrophe. [[Cross-Site Request Forgery]] (CSRF) is an attack whereby the victim is tricked into loading information from or submitting information to a web application for which they are currently authenticated. The problem is that the web application has no means of verifying the integrity of the request.
+Just when developers are starting to run in circles over [[Cross Site Scripting Flaw]], the [http://www.darkreading.com/document.asp?doc_id=107651&WT.svl=news1_2 'sleeping giant'] awakes for yet another web-catastrophe. [[Cross-Site Request Forgery]] (CSRF) is an attack whereby the victim is tricked into loading information from or submitting information to a web application for which they are currently authenticated. The problem is that the web application has no means of verifying the integrity of the request.
 ==Recommended Prevention Measure: Unique Request Tokens==

← Older revision		Revision as of 04:50, 19 November 2007
Line 1:		Line 1:
		+	#REDIRECT [[:Category:OWASP CSRFGuard Project]]
		+
	==Overview==		==Overview==

@@ Line 289: / Line 289: @@
 === Download ===
-The Proof-of-Concept implementation of the Cross-Site Request Forgery Guard discussed in this article can be downloaded [http://www.owasp.org/index.php/Image:CSRF_Guard.zip here]
+The Proof-of-Concept implementation of the Cross-Site Request Forgery Guard discussed in this article can be downloaded here: [[:Image:CSRF_Guard.zip|CSRF_Guard.zip]]
-A Proof-of-Concept implementation of the CSRF Guard for the PHP platform is under development [http://www.owasp.org/index.php/PHP_CSRF_Guard here]
+=== Related Projects ===
-A Proof-of-Concept implementation of the CSRF Guard for the ASP.Net platform (as an ASP.Net Module/Filter) is under development and will be part of the OWASP .Net project toolset.  Contact [[User:Jaxley|Jaxley]] for details.
+A Proof-of-Concept implementation of the CSRF Guard for the PHP platform is under development: [[PHP CSRF Guard]]
 ==References==
@@ Line 300: / Line 302: @@
 :* http://java.sun.com/j2se/1.4.2/docs/api/java/security/SecureRandom.html
 [[Category:OWASP_Validation_Project]]
 [[Category:Countermeasure]]
 [[Category:Java]]

← Older revision		Revision as of 23:46, 16 November 2007
Line 292:		Line 292:

	A Proof-of-Concept implementation of the CSRF Guard for the PHP platform is under development [http://www.owasp.org/index.php/PHP_CSRF_Guard here]		A Proof-of-Concept implementation of the CSRF Guard for the PHP platform is under development [http://www.owasp.org/index.php/PHP_CSRF_Guard here]
		+
		+	A Proof-of-Concept implementation of the CSRF Guard for the ASP.Net platform (as an ASP.Net Module/Filter) is under development and will be part of the OWASP .Net project toolset.

	==References==		==References==

@@ Line 208: / Line 208: @@
              sr.nextBytes(random);
-             digest = encoder.encode(random);
+             digest = encoder.encode(random).replace('+', '_');
          } catch (Exception e) {
              e.printStackTrace();

@@ Line 1: / Line 1: @@
 ==Overview==
-Just when developers are starting to run in circles over [http://www.owasp.org/index.php/Cross_Site_Scripting Cross Site Scripting (XSS)], the [http://www.darkreading.com/document.asp?doc_id=107651&WT.svl=news1_2 'sleeping giant'] awakes for yet another web-catastrophe. [http://www.owasp.org/index.php/Cross-Site_Request_Forgery Cross-Site Request Forgery (CSRF)] is an attack whereby the victim is tricked into loading information from or submitting information to a web application for which they are currently authenticated. The problem is that the web application has no means of verifying the integrity of the request.
+Just when developers are starting to run in circles over [[Cross Site Scripting]], the [http://www.darkreading.com/document.asp?doc_id=107651&WT.svl=news1_2 'sleeping giant'] awakes for yet another web-catastrophe. [[Cross-Site Request Forgery]] (CSRF) is an attack whereby the victim is tricked into loading information from or submitting information to a web application for which they are currently authenticated. The problem is that the web application has no means of verifying the integrity of the request.
 ==Recommended Prevention Measure: Unique Request Tokens==
@@ Line 59: / Line 59: @@
 === Implementation ===
-The following Java EE Filter will attempt to verify the integrity of the request by comparing the OWASP_CSRFTOKEN HTTP parameter value with that of the OWASP_CSRFTOKEN session attribute. If the two values do not match, then the request is forged and we invoked the doError() method. This method will invalidate the existing session and redirect the user to a page specified by the filter init-parameter "error-page". If the parameter value equals the corresponding session attribute value, then we call doChain() and pass the request to the web application. Once the web application is finished processing the request, the buildLinkParameters() method will search the HTML response for forms and links and insert the appropriate OWASP_CSRFTOKEN parameter value. Unfortunately, the dependency on an HTML response means that the current filter may not work with some Web 2.0 applications. Furthermore, the filter only modifies response objects whose "Content-Type" header is text based. If your web application neglects to set the appropriate value for the "Content-Type" header, then the CSRF Guard will not make the appropriate changes to the HTML response and each subsequent request will be considered a violation.
+The following Java EE Filter will attempt to verify the integrity of the request by comparing the OWASP_CSRFTOKEN HTTP parameter value with that of the OWASP_CSRFTOKEN session attribute. If the two values do not match, then the request is forged and we invoked the doError() method. This method will invalidate the existing session and redirect the user to a page specified by the filter init-parameter "error-page". If the parameter value equals the corresponding session attribute value, then we call doChain() and pass the request to the webapplication. Once the web application is finished processing the request, the buildLinkParameters() method will search the HTML response for forms and links and insert the appropriate OWASP_CSRFTOKEN parameter value. Unfortunately, the dependency on an HTML response means that the current filter may not work with some Web 2.0 applications. Furthermore, the filter only modifies response objects whose "Content-Type" header is text based. If your web application neglects to set the appropriate value for the "Content-Type" header, then the CSRF Guard will not make the appropriate changes to the HTML response and each subsequent request will be considered a violation.
   /*

@@ Line 294: / Line 294: @@
 ==References==
 :* http://news.com.com/Netflix+fixes+Web+2.0+bugs/2100-1002_3-6126438.html?tag=cd.lede
 :* http://shiflett.org/articles/foiling-cross-site-attacks