A Client-Based and Server-Enhanced Defense Mechanism for Cross-Site Request Forgery

Abstract

AbstractA common-sense CSRF attack involves more than one domain. In this paper, we’ll cover both cross-domain and same-domain CSRF which overlaps with Cross-Site Scripting (XSS). If a XSS instructs victims to send requests to the same domain, it is also a CSRF–same-domain CSRF. Such sort of XSS-CSRF exists extensively and even high profile sites cannot always avoid such vulnerabilities.There exist mainly 3 defenses: Referer Header checking, secret validation token and CAPTCHA. The Referer Header is sometimes missing [1], the secret token becomes totally futile when XSS exists and the CAPTCHA is too bothering. Besides, [2-3] brings about some client-taking actions yet pure client checking is not credible enough from server side perspective. And they still suffer from the Referer-missing problem. Moreover, all of [1-3] have nothing to do with same-domain CSRF. So a client-initialized and server-accomplished defense mechanism (CSDM) is proposed.KeywordsServer SideForgery AttackTarget PagePost RequestPolicy FileThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.