CSRF protection method and system based on cloud platform

Abstract

The invention discloses a CSRF (Cross-Site Request Forgery) protection method and system based on a cloud platform. The method comprises the following steps: receiving a request packet to be analyzed; checking the login state of the request packet, and directly releasing the request packet which does not log or has logged and does not include a request parameter; checking the request packet which has logged and includes a request parameter; and judging whether the request packet is directly released or released after the cache is cleared according to the checking result. The CSRF protection method and system based on the cloud platform have the advantages: by judging the login authority of a request access system, erroneous intercepting behaviors on open operating interfaces can be reduced, the detection efficiency can be improved, and the influence on the performance of the cloud platform can be reduced; and by recognizing the request mode, configuring sensitive operation parameters and performing relevant processing on the requested referer, CSRF protection on the whole website can be realized, the configuration is simple and convenient, and the requirement for the profession of operators is low.

Description

technical field [0001] The invention relates to the field of computer network data security, in particular to a cloud platform-based CSRF protection method and system. Background technique [0002] With the rapid development of global wide area network (World Wide Web, WEB) application technology, there is an attack method on the Internet that hijacks other end users to perform malicious operations on their application systems when they are logged in. -site Request Forgery, CSRF). This attack method can perform functional operations on the WEB application without the victim's knowledge. Specifically, when the victim successfully logs in to a WEB application system, the victim requests to visit the link page constructed by the attacker during use. While the page is loading, the attacker has completed the CSRF attack with the pre-constructed code, and successfully used the victim's user authority to execute the functional operation of the WEB application system, threatening t...

AI Technical Summary

Problems solved by technology

[0004] However, these protection methods still have some disadvantages: (1) the token tracking method needs to analyze the Document Object Model (DOM) of the web page, locate the position of the form, modify the content of the form request and a series of complex operations, and the protection efficiency is low; (2) Other protection methods configure the protection address according to the business function. The change of the business function will affect the use of the protection function, and the configuration content needs to grab the business address one by one, and the configuration process is cumbersome

Images