课程: Programming Foundations: Web Security

今天就学习课程吧！

今天就开通帐号，24,600 门业界名师课程任您挑！

Cross-Site Request protections

Cross-Site Request protections

课程: Programming Foundations: Web Security

开始一个月试用 购买团队方案

Cross-Site Request protections

“

- Let's learn how to protect our websites from cross site request forgery attacks. The simplest defense against CSRF attacks is to put thought into which pages use GET and POST requests. Use GET requests for retrieving data, not for actions which make changes. Use POST requests such as form submissions for actions which make changes. An image source tag will always send a GET request. The HTML is expecting to read an image, not to make a change. If the bank required transfers to use POST requests, then this URL would be rejected for being the wrong request type. Now, this does not prevent all CSRF attacks, but it prevents those that are easiest to craft. The strongest defense against CSRF attacks is to use CSRF tokens. Here's how it works. First, you generate a long, unique random string which can act as a token. Then you store it in the user's session data. The session data is usually kept on the server so that…

内容