Cross Site Request Forgery

These attacks could occur due to the vulnerabilities of the code of the web applications. In these attacks attacker forces the browser to make unauthorized requests, behalf of the user. 

This can be explained as follows ,

•         The user logs in to a web page and login to that page using his user credentials, assume that this web page is vulnerable to cross site request forgery.

•         Then the user visits a web site without knowing the page is maintained by an attacker. This site contains CSRF attacks.

•       When the script gets executed, the user’s browser make request to the that vulnerable website.

There are some mitigation methods we can use to prevent the CSRF attacks,

             1. Synchronizer token pattern.

            2. Double submit cookie pattern.
Let’s look at the implementation of these two methods using Java. 

1) Synchronizer token patter

        In synchronizer token pattern, we generate a CSRF token upon successful login and save that value in the form of the page as a hidden field. CSRF token is string that    has been randomly get generated.This value also need to be saved in the server side endpoint.When user loges in we need to create the session a session identifier, and store it as  a cookie.Since the domains are different, attackers can’t execute cross domain AJAX request. In synchronizer token pattern, it uses two token. One is stored in the session and the  other one is saved in UI. The token values get compared in the server.

Figure 1

First you need to create a jsp file with a login form, as shown in the 

Figure 2,

Figure 2

  When user enter his user credentials and click on submit button we redirect him to the next page if the credentials are correct. Upon this we need to create the session cookie and need to generate the token.

Figure 3

  In here I have generated the CSRF token value and created the session cookie upon user login. The I have redirected the user to stpform.jsp page.

Figure 4

 This page contains another form. In here you can see that there is hidden field which holds the CSRF Token value. When user submit this form we need to validate the token values.This can be done by comparing the value that hold in this hidden field with the value stored in the server endpoint.

Figure 5

  In here I have performed the token validation.The token value saved in the form has been compared with the token value stored in the server endpoint.

If the values get matched, we redirect the user to the nest.jsp file. 

2) Double submit cookie pattern

  Main difference of the implementation of double submit cookie pattern when comparing to the synchronizer token pattern is, It does not save the CSRF token value in the server side.
Both tokens are held in the UI. One token is stored in the http auth header and the other one is saved in the cookie.

Figure 6

Figure 7

  Upon successful user login I have generated the token and stored it as a cookie and in the hidden field of the form (UI). Then we need to validate the token values.

  This can be done by comparing the token value stored in the UI and the token value stored in the cookie.

  If the tokens get matched, we allow the user request.

Figure 8

       You can see a sample project (GitHub) :-  Cross Site Request Forgery Attacks