csrf

XSS攻击和CSRF攻击与防范

由 跟風遠走 提交于 2020-01-02 20:21:41
这两个也是我个人在面试时候经常被问到的（前端较多，有的公司要你前后端都做的或者需要你对这些有所了解的也会问到你），不得不说这些东西在日常业务开发中还真是比较少机会遇到，但是也要考虑到才算周全。 什么是XSS？？ 首先XSS攻击是Cross Site Scripting （跨站脚本）的变形缩写，为啥不缩写成CSS呢，因为那就会跟修饰页面的Cascading style sheets （层叠样式表CSS）搞混了，所有学过HTML的人都必学的CSS，内外联标签配上它，就可以调长宽高，设置大小，弄得漂亮。 为什么叫跨站？XSS攻击会有什么危害？ 这个就是字面意思，就是心怀不轨的故意写植入代码的人在远程的机器上的web页面的HTML代码中插入恶意代码，植入成功后，所有浏览这个页面的人，都会受到这段恶意代码的影响；简单点的恶作剧，就alert弹出一些无聊的提示框，修改一些URL的链接去一些不健康的网站，伪造擅改一些页面信息等。性质恶劣一点的，就是把自己隐藏起来，在你输入账号密码等重要信息的时候通过标签拿到偷偷发一份到远端的一个接口或者网站做处理。 XSS攻击有哪几种？ XSS攻击有三种：反射型XSS；存储型XSS；dom型XSS。 1.反射型（非持久性XSS攻击）： 为什么叫反射型，就是像扔球一样，别人把球抹上点屎（带XSS的脏URL），你一开始没看清楚（被诱导着点了链接），拿起来扔出去

Is Firebase Auth's local (persisted auth state) secure and safe from XSS and CSRF for browsers?

由 夙愿已清 提交于 2020-01-02 07:15:12
问题 I am using Firebase Auth for a web app that involves financial transactions. Thus, security is the most important thing for my app. According to this doc, Firebase can persist its token across multiple sessions by storing it somewhere. It does not mention how safe it is from XSS. Of course, I can just assume it's safe because it's Google, but I want to know more about it. We've all read articles noting how localStorage is unsafe for storing auth, and cookie + csrf token + jwt + httpOnly is

Remove csrf protecteion on API post calls

由 拈花ヽ惹草 提交于 2020-01-02 04:44:07
问题 I would like to remove csrf from my Express 3.0 application as i don't need it there. I use oauth to validate clients. Is the a middleware to whitelist API urls when using express.csrf()? 回答1: You can do that in two ways. 1.) Create a small middleware of your own to allow white list url patterns not to be blocked by csrf like; var express = require("express"); var expressCsrf = express.csrf(); var app = express.createServer(); var customCsrf = function (req, res, next) { // I assume exact

CSRF - Can forged POSTs contain arbitrary data?

由 蹲街弑〆低调 提交于 2020-01-01 11:33:47
问题 Forged POST requests can be constructed by untrusted websites by creating a form and posting it to the target site. However, the raw contents of this POST will be encoded by the browser to be in the format: param1=value1&param2=value2 Is it possible for untrusted websites to construct forged POSTs which contain arbitrary raw content -- such as stringified JSON? {param1: value1, param2: value2} Put another way: Can websites cause the browser to POST arbitrary content to third-party domains?

Preventing CSRF?

由 左心房为你撑大大i 提交于 2020-01-01 11:09:15
问题 I already seen some question from here (stackoverflow) and THIS post, but I still have some questions... Using hidden value in the post form and check it when post reach the server. The hidden value can easy be copied and send exactly like the real one, "hard to guess" (like md5) will not help. (right?) Setting a cookie when you reach the form and send the cookie value as a hidden value. You can easily change a cookie value or send a custom cookie exactly like the real one using the same real

Preventing CSRF?

由 筅森魡賤 提交于 2020-01-01 11:08:13
问题 I already seen some question from here (stackoverflow) and THIS post, but I still have some questions... Using hidden value in the post form and check it when post reach the server. The hidden value can easy be copied and send exactly like the real one, "hard to guess" (like md5) will not help. (right?) Setting a cookie when you reach the form and send the cookie value as a hidden value. You can easily change a cookie value or send a custom cookie exactly like the real one using the same real

How to get CSRF token with rails3.2.x, before sending restful POST/PUT API, without any form/UI from server side?

由 时光怂恿深爱的人放手 提交于 2020-01-01 11:03:06
问题 I know rails provided CSRF protection by default from rails3. but my web application is a single page application, and all communication depend on ajax. So, how can I get CSRF token from server before each ajax calling? or what I can do is just take off CSRF protection, right? NOTE: we don't use any rails view to produce the web page, even the homepage, so the solution to put "<%= csrf_meta_tag %> " in .html or .erb is invalid ., we use javascript framework within one page. my env: rails3.2.3

How to get CSRF token with rails3.2.x, before sending restful POST/PUT API, without any form/UI from server side?

由 半世苍凉 提交于 2020-01-01 11:02:58
问题 I know rails provided CSRF protection by default from rails3. but my web application is a single page application, and all communication depend on ajax. So, how can I get CSRF token from server before each ajax calling? or what I can do is just take off CSRF protection, right? NOTE: we don't use any rails view to produce the web page, even the homepage, so the solution to put "<%= csrf_meta_tag %> " in .html or .erb is invalid ., we use javascript framework within one page. my env: rails3.2.3

CSRF tokens - how to implement properly?

由 非 Y 不嫁゛ 提交于 2020-01-01 08:20:51
问题 I've just setup a simple CSRF protection in my application. It creates a unique crumb which are validated against a session value upon submitting a form. Unfortunately this means now that I can't keep multiple instances (tabs in the browser) of my application open simultaneously as the CSRF crumbs collide with each other. Should I create an individual token for each actual form or use a mutual, shared crumb for all my forms? What are common sense here? 回答1: You can do either. It depends on

Slim3 exclude route from CSRF Middleware

由 雨燕双飞 提交于 2020-01-01 07:02:11
问题 I'm building a webshop based on the slim3 framework. I need to handle a server-to-server POST-request to confirm if payment was successful. I added csrf to the container like this: $container['csrf'] = function($container) { return new \Slim\Csrf\Guard; }; and added it to the app like this: $app->add($container->csrf); And it works good. But now i need to be able to add an exception to a certain route so i get the post reques they are sending. I'couldn't find a working solution so far. Any
订阅 csrf