Securing app from CSRF/XSRF
In order to provide protection against CSRF attacks, the following techniques are recommended by OWASP:
- The application needs to make sure that the request is generated from the real application, and not from another website. In order to achieve this, it needs to be verified that origin or referer header consists of a hostname matching the target origin hosting the real application. If both origin and referrer header is missing in HTTP request headers, it is recommended that requests are blocked. This technique is very effective, as all browsers implement the same origin policy.
- Another mechanism is to verify the correctness and validity of what is termed as the CSRF or XSRF token. A challenge random token is generated by the server and associated with the current user session by sending the token as a part of response header or, making it as a hidden parameter of one or more generated forms. This token is, then, sent with every subsequent sensitive operations or...
