csrf | 易学教程

Yii 2.0 CSRF validation for AJAX request

阅读更多关于 Yii 2.0 CSRF validation for AJAX request

I have an ajax function that triggers an entry deletion from my database. I need to do CSRF validation for the same. How can I do that? I am sending the CSRF cookie along with my post request, but Yii 2.0 is not validating it and any input that is passed through ajax is reaching the server. How do I do CSRF validation for ajax requests. Whether we need to manually set cookie and check? You don't need to manually set cookie. If you are using jQuery CSRF token will be sent automatically. For example for AngularJS you can add it manually to request params like that: yii.getCsrfParam(): yii

Symfony 2 - Delete Forms and CSRF Token

阅读更多关于 Symfony 2 - Delete Forms and CSRF Token

I have a List of entries coming from a database. I would like to have a "Delete-Button" at the end of every row, so that the user won't have to first go to the edit/show page to delete the entry. I tried creating a hidden input field with the csrf token like so: return $this->createFormBuilder() ->getForm() ; this will output: <div id="form"> <input type="hidden" id="form__token" name="form[_token]" value="6c98ebfa9df07....."> </div> The rest of the Form i put around in the twig template so that every form has its own action path according the the id of the entry. unfortunately in the twig

CSRF issue with Spring + Angular 2 + Oauth2 + CORS

阅读更多关于 CSRF issue with Spring + Angular 2 + Oauth2 + CORS

I am developing a client-server application based on Spring 4.3 and Angular (TypeScript) 4.3, in a CORS scenario where, in production, server and client are on different domains. Client ask for REST server APIs via http requests. 1. REST AND OAUTH CONFIGURATION: The server exposes REST APIs: @RestController @RequestMapping("/my-api") public class MyRestController{ @RequestMapping(value = "/test", method = RequestMethod.POST) public ResponseEntity<Boolean> test() { return new ResponseEntity<Boolean>(true, HttpStatus.OK); } } Protected by Oauth2 as explained on spring documentation. Obviously I

How can I check whether the supplied CSRF token is invalid in Symfony2?

阅读更多关于 How can I check whether the supplied CSRF token is invalid in Symfony2?

I have created a Symfony2 form and bound it to the Request. I need to explicitly ensure whether the CSRF token is valid/invalid before proceeding with the rest of the form. $form['_token']->isValid() throws OutOfBoundsException with message "Child _token does not exist." I can still verify that the rendered form contains _token field. In case that CSRF value is invalid, $form->isValid() returns false. What am I missing here? Update 1: Controller (partial): private function buildTestForm() { $form = $this->createFormBuilder() ->add('name','text') ->getForm(); return $form; } /** * @Route("/test

Spring MVC : How to Protect Application from CSRF and XSS

阅读更多关于 Spring MVC : How to Protect Application from CSRF and XSS

问题 What is the best way to protect our Spring MVC application from CSRF and XSS. Is there native Spring MVC support for this? 回答1: In Spring: Forms ( globally): <context-param> <param-name>defaultHtmlEscape</param-name> <param-value>true</param-value> </context-param> Forms ( locally): <spring:htmlEscape defaultHtmlEscape="true" /> 回答2: You can use Spring Security 3.2.0.RELEASE and enable csrf support with this configuration <http>  <csrf /> </http> 回答3: Here is a blog about it. http

How to selectively disable CSRF check in Phoenix framework

阅读更多关于 How to selectively disable CSRF check in Phoenix framework

I'm trying to create a Facebook Page Tab which points to my website. Facebook sends a HTTP POST request to the url of my website. The problem here is that the server has a built-in CSRF check, and it returns the following error: (Plug.CSRFProtection.InvalidCSRFTokenError) invalid CSRF (Cross Site Forgery Protection) token, make sure all requests include a '_csrf_token' param or an 'x-csrf-token' header` The server expects a CSRF token that Facebook can't have. So, I want to selectively disable CSRF for the path www.mywebsite.com/facebook. How can I do it in Phoenix Framework? The Plug

Yii2 Unable to verify your data submission 错误-CSRF

阅读更多关于 Yii2 Unable to verify your data submission 错误-CSRF

Yii2 功能很是强大，组件化编程很高大上，全栈编程很容易，但我觉得日常的开发中还是有很大一部分人会去手写表单之类的，为了配合前端的工作，或者懒得再去学这套堪比一门新语言的组件语法.... Yii2默认是对表单采取 CSRF 验证的，近些年 CSRF 也越来越被人们所在意，它比 XSS 更阴险更精明，有兴趣的可以百度下网络安全编程方面的相关知识，这里就不再累述了。如果是自己手写的表单，且没有关闭 Yii2 自身的 CSRF 验证的话，就会出现 “Unable to verify your data submission” 的错误提示，而网上千篇一律的都是教你如何关闭 CSRF 验证，我也是呵呵了，居心何在？安全编程要贯彻到底，如果你不想过几年被搞网络安全的挤下去么。有几篇教你如何使自己的表单符合 CSRF 验证，但都是 Yii 版本的，组件的写法都与现在的 Yii2 大有不同下面给出正确的表单写法 <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <title>FormValidate</title> </head> <body> <div> <form method="post" action=""> <input type="text" name="username"> <input type="submit"

ASP.NET MVC - CSRF on a GET request

阅读更多关于 ASP.NET MVC - CSRF on a GET request

We have a ASP.NET MVC application. All the POST requests (form submits) have been protected from CSRF by using @Html.AntiForgeryToken and ValidateAntiForgeryToken attribute. One of the action methods on a controller is a GET which returns a report to the user (a pdf file with data from database). The signature is: [AcceptVerbs(HttpVerbs.Get)] public ActionResult GetReport() { // get data from db return GetReport(); } Here are the steps I am following to test the CSRF against this operation: User logs into the application When logged in , user opens the below HTML file and clicks on the Submit

How is using Synchronizer Token Pattern to prevent CSRF safe?

阅读更多关于 How is using Synchronizer Token Pattern to prevent CSRF safe?

问题 I have been reading about using a synchronizer token pattern to prevent CSRF (CSRF meaning Cross-site request forgery.), and I don't understand how it actually safe. Let's say I have a fake bank site fakebank.com with two urls: fakebank.com/withdrawForm.html - a GET request which displays the withdraw money form fakebank.com/doWithdraw - POST to this url to do the withdraw My understanding of the security flaw is that maliciousSite.com can spoof a POST request to fakebank.com/doWithdraw , and

AntiForgery.GetTokens: what is the purpose of the oldCookieToken parameter?

阅读更多关于 AntiForgery.GetTokens: what is the purpose of the oldCookieToken parameter?

We're writing an iOS mobile app in objective-c that makes posts to our ASP.NET MVC server app. On iPhone, the HTTP stack (and cookies etc) appear to be shared with Safari. This leaves us open to XSRF attacks, so unless I'm mistaken we need to protect the POSTs with anti-forgery tokens and protect our controller methods with ValidateAntiForgeryTokenAttribute . I'll qualify this question by saying that I don't properly understand the mechanism by which the antiforgery tokens are generated and verified... in particular, the term 'nonce' used in this context is somewhat mystical. Because we're not