Prevent CSRF Vulnerabilities, Alternative methods to CSRF Token

Question

A common way to prevent CSRF is using tokens hidden in forms. Just by curiosity is this the only way of actually preventing CSRF? People arguing about CSRF token not needed is making me crazy and I need to understand why. How can I else prevent CSRF attacks?

You should google for CSRF OWASP and read their guidance. CSRF tokens are basically the most effective way to prevent CSRF. — atk
– atk, Commented Mar 9, 2013 at 19:21

Kasun Dharmadasa · Accepted Answer · 2017-10-15 16:36:42Z

1

Actually using a CSRF token is just another layer of defense. According to the OWASP Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet, verifying the request origin can also be used in CSRF protection. To verify the origin we can use,

Origin Header
- The Origin header includes the information of the scheme,host and port that initiated the request.
Referer Header
- The Referer header contains the address of the previous web page from which a link to the currently request web page was followed.

However there are limitations in using this approach such as unavailability and integrity of the headers. There are ways for attackers to change the value of these headers. Therefore it is recommended to always have multiple layers of defense.

answered Oct 15, 2017 at 16:36

Kasun Dharmadasa

1216 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Prevent CSRF Vulnerabilities, Alternative methods to CSRF Token

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related