Cross-site Request Forgery Protection in Web Applications via Synchronizer Token

What Is CSRF?

Cross site request forgery (CSRF), also known as XSRF, Sea Surf or Session Riding, is an attack vector that tricks a web browser into executing an unwanted action in an application to which a user is logged in.

A successful CSRF attack can be devastating for both the business and user. It can result in damaged client relationships, unauthorized fund transfers, changed passwords and data theft—including stolen session cookies.

CSRFs are typically conducted using malicious social engineering, such as an email or link that tricks the victim into sending a forged request to a server. As the unsuspecting user is authenticated by their application at the time of the attack, it’s impossible to distinguish a legitimate request from a forged one.

Implement Synchronizer Tokens

Synchronizer tokens are often referred to as “challenge” tokens. These challenge tokens are included within an HTML form and associated with sensitive server-side tasks. When a user wants to execute a sensitive operation the request needs to include the challenge token.

On the server side, the web application verifies that the request includes the token. If it does not, the server rejects the request. Note that this method does require a server side state to be stored and quickly accessible. It is currently considered the best way to prevent CSRF attacks.

Let's get started with a sample code. just follow this link and get the files: https://github.com/csandeepa/CSRF-synchronizer-token

Once you run it, you can see a login page like this.

There are three files called index.php, update.php and logout.php. As usual, index.php is the very first page that is loaded when you request the site. There you can see all the implementations of the contents of the form. the form submission method is POST.

Session generation and login credential validation part looks like this. After the validation process is success, the user is redirected to update.php page. 

You can see the CSRF token generation and token validation part in the update.php file.

Here is the way of implementing synchronizer tokens for a login. CSRF prevention is really important for security of a website.

~CS