Preventing CSRF?

Question

I already seen some question from here (stackoverflow) and THIS post, but I still have some questions...

1. Using hidden value in the post form and check it when post reach the server.

   • The hidden value can easy be copied and send exactly like the real one, "hard to guess" (like md5) will not help. (right?)

2. Setting a cookie when you reach the form and send the cookie value as a hidden value.

   • You can easily change a cookie value or send a custom cookie exactly like the real one using the same real hidden value. (right?)

3. Using 'timeout', the POST values cannot reach too late.

   • So, if you're slow you will fail when you try to set everything up with the hidden value. If you're fast it gonna work. (right?)

I want to be protected about CSRF...but how exactly I do it?

Answer 1

The easiest way I found to prevent CSRF issues is:

1. On the server side, assign an HttpOnly cookie to the client with a random (unguessable) token

2. Place a hidden field on the form with that cookie value

3. Upon form submit, ensure the hidden field value equals the cookie value (on the server side of things)

Answer 2

If you make the following changes then I think you're safe

• no data updates should be allowed through GET (or better POST as well) (since both can be used through HTML forms)
• disable CORS on your server (or at least on endpoints that are critical and/or make changes to data)
• allow JSON-only APIs (ie. only accept input through JSON on critical endpoints at least)

Just to add to above: Do not use method overrides and do not support old browsers.