I am going to avoid a CSRF attack in my web application.
I configured the csrf configuration on my apache, for example:
<VirtualHost> ... CSRF_Enable on CSRF_Action deny CSRF_EnableReferer off </VirtualHost>
In addition, I installed the following apache modules:
mod_csrf-0.3 mod_parp-0.12 mod_setenvifplus-0.23
which are able to ignore CRSF in some cases.
Everything works fine, namely csrfpid adds to all POST methods and does not add GET.
But one problem was found. When I try to send the GET method with the parameter: www.example.com/test.jsp?csrfpid=some_csrf_id&some_attribute=0 , csrfpid is attached to the link.
I tried to play with:
SetEnvIfPlus Request_Method "GET" CSRF_IGNORE=yes.
But this does not work in my case.
In addition, I found that the problem is with the mod_csrf.c file.
It will be useful to get some ideas or useful links regarding the case described.
source share