Is this CSRF countermeasure effective?

Question

Please let me know if the following CSRF protection approach is effective.

• Create token and save on server
• Send token to client using cookie
• Javascript on the client reads the cookie and adds the token to the form before POSTing
• The server compares the token in the form with the stored token.

Can anyone see any vulnerabilities when sending a token via a cookie and reading it using JavaScript instead of putting it in HTML?

Answer 1

The synchronizer token pattern is based on a comparison of random data known on the client with the published form. Although you usually get the last of a hidden form filled with a token while the page is being displayed, I don't see any obvious attack vectors using JavaScript to populate it. An attacking site would need to be able to read a cookie to recover a send request, which obviously could not be completed due to cookie restrictions for multiple domains.

You can find OWASP Top 10 for .NET Developers Part 5: Cross-Site Subroutine (CSRF) useful (lots of general CSRF information), in particular a section on resource sharing using different sources.

Answer 2

If a person’s traffic is monitored, the hacker will most likely also receive a token. But that sounds like a great plan. I would try adding honeypot. Try to disguise the token as something else, so this is not obvious. If this happens, send the bad user to honeypot so they don’t know what they were.

My security philosophy is simple and better illustrated by history.
Two men walk in the woods. They see a bear, a freak and start to run. When a bear catches up with them, and one of them tells the other, "we will never defeat this bear." another guy replies: "I do not need to overtake the bear, I only need to overtake you!"

Everything you can add to your site to make it more secure will get better. Use the framework, check all inputs (including everything in any public method), and you should be fine.

If you store sensitive data, I would install a second sql server without internet access. Ensure that your server server constantly accesses your front-end server by pulling and replacing sensitive data with dummy data. If your front-end server needs this sensitive data, which most likely uses a special method that uses another database user (who has access) to pull it from an external server. Someone will have to fully own the machine to understand this ... and still take enough time for you to pull out the plug. Most likely, they will pull all your data before they realize that it is a fake ... haha.

I would like to have a good decision on how best to protect my clients in order to avoid CSRF. But what you have seems like a pretty good deterrent.

Answer 3

This Security Stack Exchange question has a helpful discussion on this.

I especially like the @AviD answer:

Don't. - Most common frameworks have this protection already built in (ASP.NET, Struts, Ruby I think), or there are existing libraries that have already been vetted. (eg OWASP CSRFGuard).