CSRF (Cross-site request forgery) cross-site request forgery
Concept: refers to the hacker lures the user to open the hacker's website, and in the hacker's website, uses the user's login status to initiate a cross-site request. Simply put, a CSRF attack means that hackers take advantage of the user's login status and do some bad things through a third-party site .
Attack method:
1- Automatically initiate a Get request
For example, hide the transfer request in the img tag, trick the browser that it is a picture, and initiate the transfer request when it is loaded
2- Automatically initiate a POST request
Build a hidden form in the webpage, which contains the transfer interface. By inducing the user to log in, the form is automatically submitted to perform the transfer operation.
3- Encourage users to click on the link
By inducing users to click on the link containing the transfer interface, the transfer of user funds is realized.
In summary, CSRF attacks do not need to inject malicious code into the user's page, but use the server's vulnerabilities and the user's login status to achieve unexpected attacks.
How to prevent CSRF attacks:
Three necessary conditions for launching a CSRF attack:
1- The target website must have a CSRF vulnerability
2- The user has logged in to the target site and remains logged in to the site on the browser
3- Need the user to open a third-party site, which can be a hacker's site, or some forum
If the above three conditions are met, hackers can conduct CSRF attacks.
How to prevent the server from being attacked by CSRF, there are usually the following ways:
1- Make full use of the SameSite attribute of Cookie
Set the SameSite attribute in the cookie to realize the transmission of some key cookie data
2- Verify the origin site of the request
Determine whether to prohibit requests from third-party sites by setting the Referer and Origin attributes in the HTTP request header
3-CSRF Token
When a request is made to the server, the server generates a CSRF Token. If the client wants to initiate a transfer request, it needs to bring this Token, and the server will check whether the Token is legal. If it is a request initiated by a third party, it will be rejected if it is not available or illegal. .
Reference: Geek Time - How Browsers Work and Practice