Mod csrfprotector - Revision history

A V Minhaz: info about todos added

2015-08-26T10:17:04Z

info about todos added

A V Minhaz at 18:09, 24 June 2014

2014-06-24T18:09:59Z

A V Minhaz at 18:06, 24 June 2014

2014-06-24T18:06:48Z

A V Minhaz at 17:46, 24 June 2014

2014-06-24T17:46:56Z

A V Minhaz: Created page with "

mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks

2014-06-24T11:50:18Z

Created page with "<h2>mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks</h2>"

New page

<h2>mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks</h2>

@@ Line 23: / Line 23: @@
 For discussions, join our mailing list: [https://lists.owasp.org/mailman/listinfo/owasp-csrfprotector - Mailing List]
 ==Current Status==
 Under Development

← Older revision		Revision as of 18:09, 24 June 2014
Line 26:		Line 26:
	==Current Status==		==Current Status==
	Under Development		Under Development
−
−	~~__NOTOC__ <headertabs />~~
−
−	~~[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]] [[Category:OWASP_Download]]~~

@@ Line 1: / Line 1: @@
 <h2>mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks</h2>
 ==What is mod_csrfprotector==
@@ Line 19: / Line 17: @@
 ==Damages Mitigated==
 * Cross Site Request Forgery
 ==How to contribute==
@@ Line 28: / Line 25: @@
 ==Current Status==
-<h2>Under Development</h2>
+Under Development

← Older revision		Revision as of 17:46, 24 June 2014
Line 1:		Line 1:
	<h2>mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks</h2>		<h2>mod_csrfprotector - Apache 2.x.x Modules for mitigating CSRF attacks</h2>
		+	{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-
		+	\| valign="top" style="border-right: 1px dotted gray;padding-right:25px;width:75%" \|
		+
		+	==What is mod_csrfprotector==
		+	Its an Apache 2.x.x Module (Currently 2.2.x) under development. It can be installed and configured in any Apache Server to protect it against Cross Site Request Forgery attacks. <strong>mod_csrfprotector</strong> provides protection to both POST and GET requests (not enabled by default).
		+
		+	==How mod_csrfprotector works?==
		+	Once installed in Apache Server, every request that is made to the server, and validated against CSRF attacks by the input filters. Input filter follows a protocol as mentioned by developer in configuration, which helps the module to decide weather to validated the request. The input filter checks for appropriate token sent with request. Request if forwarded to other filters or content generator (like php or cgi) in validation is successful. Otherwise, appropriate actions are taken as per configuration. For ex: 403, Forbidden header is send to client.
		+	The Output filter, checks for content type of output generated by content generator and if it is `text/html` or `text/xhtml` it appends javascript code to the output. This js code in client side is responsible for attaching CSRFP_token with every required request sent from client.
		+
		+	==Features Offered==
		+	CSRF Protection provide protection for:
		+	* Normal HTML forms (POST/GET)
		+	* Normal Get requests (Not enabled by default)
		+	* Ajax Requests (XHR)
		+	* Dynamically generated forms
		+
		+	==Damages Mitigated==
		+	* Cross Site Request Forgery
		+	\| valign="top" style="padding-left:25px;" \|
		+
		+	==How to contribute==
		+	To contribute to the code fork and send a pull to:<br>
		+	[https://github.com/mebjas/mod_csrfprotector GitHub Repo - mod_csrfprotector]
		+
		+	For discussions, join our mailing list: [https://lists.owasp.org/mailman/listinfo/owasp-csrfprotector - Mailing List]
		+
		+	==Current Status==
		+	<h2>Under Development</h2>