Geek Answers Handbook

Protect your old web application from CSRF without adding hidden input in all forms

During a recent security audit of our Java web application, we discovered CSRF vulnerabilities. I know that for a new application that uses a security infrastructure, such as Spring Security, we could easily add hidden input with each form and perform other necessary configurations, and this would solve the problem.

<input type="hidden"
name="${_csrf.parameterName}"
value="${_csrf.token}"/>

But our very old application, still using acegi-security (1.0.2) and having 100 forms written in JSP. Adding the csrf hidden token input type in all of these forms seems very tedious. Is there a smarter way to protect my application without all this hard work.

+4
source share
2 answers

. . . SetCsrfTokenFilter. doFilter .

HttpServletRequest httpReq = (HttpServletRequest) request;
    HttpServletResponse httpRes = (HttpServletResponse) response;
    String randomLong = ""+random.nextLong();
    Cookie cookie = new Cookie("csrfToken", randomLong);        
    httpRes.addCookie(cookie);
    next.doFilter(request, response);

VerifyCsrfTokenFilter. doFilter :

String csrfToken = httpReq.getParameter("csrfToken");
        String tokenFromCookie = getCsrfTokenFromCookie(httpReq);
        if (WmUtil.isEmpty(csrfToken) || !csrfToken.equals(tokenFromCookie)) {
            httpRes.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        }           
        else {
            next.doFilter(request, response);
        }

URL- web.xml. , , jsp-, jquery .

<input type="hidden" name="csrfToken" value="readFromCookieThroughJavascript"/>

, - csrf. , javascript- , git. https://github.com/anilpank/oldWebAppCsrfProtection

0

Synchronizer Token Pattern - CSRF.

, CSRF, referer. ,

String request_origin = request.getHeader("referer");

//check if origin of the request 
//is coming from known source
if(!knownURIs(request_origin)){ 
    //reject the request 
}
else
    //process request

, HTTPS / XSS/Open, .

+1

More articles:


All Articles