CSRF Mitigation methods - Revision history

A V Minhaz at 20:20, 20 September 2014

2014-09-20T20:20:46Z

2014-09-20T20:19:59Z

2014-09-20T06:19:49Z

2014-09-20T06:19:10Z

2014-09-07T20:01:07Z

2014-09-07T20:00:36Z

2014-09-07T19:59:19Z

2014-09-07T19:56:19Z

2014-09-03T12:24:07Z

2014-09-03T12:15:47Z

@@ Line 3: / Line 3: @@
 [[Category:OWASP ASDR Project]]
 <br>
+===Note===
 ===Overview===
 CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. A successful CSRF  exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.

← Older revision		Revision as of 20:19, 20 September 2014
Line 51:		Line 51:
	* A library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.		* A library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.
	* A JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML.		* A JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML.
		+
		+	{\| class="wikitable"
		+	\|-
		+	! Properties / Tool
		+	! CSRF Guard
		+	\|-
		+	\| Dependencies
		+	\| -
		+	\|-
		+	\| Works with
		+	\| -
		+	\|-
		+	\| Current Status
		+	\| -
		+	\|-
		+	\| Protection
		+	\| -
		+	\|-
		+	\| NOJS Support
		+	\| -
		+	\|-
		+	\| More Information
		+	\| [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project Wiki] [https://github.com/aramrami/OWASP-CSRFGuard-3 Github Repository]
		+	\|}

@@ Line 42: / Line 42: @@
 | Yes (Separate version supporting NoJS)
 | No
-| -
+|-
 | More Information
 | [https://www.owasp.org/index.php/CSRFProtector_Project  Wiki] [https://github.com/mebjas/CSRF-Protector-PHP Github Repository]

@@ Line 12: / Line 12: @@
 ===OWASP CSRF Protector Project===
-OWASP CSRF Protector project comes in two parts :
+OWASP CSRF Protector is a new anti CSRF method to mitigate CSRF based attacks in web applications. It comes in two parts :
 * <b>Standalone php library: </b> This library can be both easily integrated with both existing web application or easily used while developing a new one.
 * <b>Transparent Apache Module: </b> Can be installed on Apache 2.x.x servers to provide CSRF mitigation without doing any modification in web application logic or codes.
@@ Line 42: / Line 42: @@
 | Yes (Separate version supporting NoJS)
 | No
 |}
 ===OWASP CSRF Guard Project===
-info will be added soon
+The OWASP CSRFGuard library is integrated through the use of a JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML. It comes in two parts:

@@ Line 19: / Line 19: @@
 {| class="wikitable"
 |-
-! Header 1
+! Properties / Tool
 ! CSRF Protector - php library
 ! mod_csrfprotector apache module

@@ Line 37: / Line 37: @@
 | Protection
 | CSRF Protection for php web applications
-| CSRF Protection for apache 2.2.x servers, irrespective of languages used as server side script
+| CSRF Protection for apache 2.2.x servers, irrespective of languages used as server side script!
 |}
 ===OWASP CSRF Guard Project===
 info will be added soon

@@ Line 17: / Line 17: @@
 ====Features====
-<table border='1'>
+{| class="wikitable"
-<tr>
+|-
-<th></th>
+! Header 1
-<th>CSRF Protector - php library</th>
+! CSRF Protector - php library
-<th>mod_csrfprotector apache module</th>
+! mod_csrfprotector apache module
-</tr>
+|-
-<tr>
+| Dependencies
-<td><b>Dependencies</b></td>
+| None
-<td>None</td>
+| None
-<td>None</td>
+|-
-</tr>
+| Works with
-<tr>
+| php >= 4.3
-<td><b>Works with</b></td>
+| Apache 2.2.x
-<td>php >= 4.3</td>
+|-
-<td>Apache 2.2.x</td>
+| Current Status
-</tr>
+| Alpha Version released
-<tr>
+| Alpha Version released
-<td><b>Current Status</b></td>
+|-
-<td>Alpha Version released</td>
+| Protection
-<td>Alpha Version released</td>
+| CSRF Protection for php web applications
-</tr>
+| CSRF Protection for apache 2.2.x servers, irrespective of languages used as server side script
-<tr>
+|}
 ===OWASP CSRF Guard Project===
 info will be added soon

← Older revision		Revision as of 12:24, 3 September 2014
Line 10:		Line 10:
	* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) CSRF OWASP Wiki]		* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) CSRF OWASP Wiki]
	* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet OWASP CSRF Prevention Cheat Sheet]		* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet OWASP CSRF Prevention Cheat Sheet]
		+
		+	===OWASP CSRF Protector Project===
		+	info will be added soon
		+
		+	===OWASP CSRF Guard Project===
		+	info will be added soon

← Older revision		Revision as of 12:15, 3 September 2014
Line 6:		Line 6:
	===Overview===		===Overview===
	CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.		CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.
		+	<br>For more information on CSRF visit:
		+	<br>
		+	* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) CSRF OWASP Wiki]
		+	* [https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet OWASP CSRF Prevention Cheat Sheet]