A method and device for defending against cross-site request forgery attacks

Abstract

The invention provides a method and device for defending a cross-site request forgery attack, thereby being conducive to enabling a token calibration method to be small in code modification amount, and thus achieving the purpose of being simple in function realization and small in pressure brought about for a server. The method for defending the cross-site request forgery attack comprises the steps that a client asks a server for a page and then receives page content, a script code and a service domain cookie which are returned by the server; the client operates the script code so as to generate a fixed token, writes the fixed token into the service domain cookie and sets the expiration time of the token; and the client sends a service request and the service domain cookie to the server, then receives response content of the server and displays the response content.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a method and device for defending against cross-site request forgery attacks. Background technique [0002] Cross-site request forgery CSRF (Cross-site request forgery) is a malicious use of websites. CSRF attacks are carried out by including malicious links or scripts in pages accessed by authorized users. For example: A website user A may be browsing a chat forum, while another user B is also in the forum at the same time, and the latter has just posted a picture message with a link to user A's bank. Imagine that User B writes a link to a form submission for withdrawals on User A's bank site and labels the link with an image. If user A's bank saves his authorization information in a cookie, and the cookie has not expired, then when user A's browser tries to load the image, it will submit the withdrawal form and his cookie, so that without user A's consent This tran...

AI Technical Summary

Problems solved by technology

However, the existing token verification method dynamically generates tokens and verification on the server side. The main problem is that the code changes a lot, which makes the implementation more complicated and puts a lot of pressure on the server.

Images