{"id":16888,"date":"2021-09-02T12:34:04","date_gmt":"2021-09-02T07:04:04","guid":{"rendered":"https:\/\/www.varutra.com\/?p=16888"},"modified":"2022-12-02T12:20:17","modified_gmt":"2022-12-02T06:50:17","slug":"mitigating-cross-site-request-forgery-csrf-attacks","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/","title":{"rendered":"Mitigating Cross-Site Request Forgery (CSRF) Attacks"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack-1024x535.png\"  class=\"sh-overlay-item sh-table-cell ls-is-cached lazyloaded\" data-rel=\"lightcase\" title=\"Mitigating CrossSite Request Forgery Attacks - Varutra Consulting\"><\/p>\n<h3><strong>What is Cross-Site Request Forgery (CSRF)?<\/strong><\/h3>\n<p>Cross-Site Request Forgery (CSRF) is a widely known web security vulnerability that enables a malicious user to induce another user(s)into performing unintended sensitive actions.<\/p>\n<p>If CSRF is exploited successfully, the attacker causes the victim to trigger a sensitive and\/or state-changing action unintentionally. They are not just limited to changing the email address on the victim\u2019s account, but also change the victim\u2019s password, and delete the victim&#8217;s account.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-16891 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/An-example-of-a-CSRF-attacks-flow.png\" alt=\"An example of a Cross-Site Request Forgery (CSRF) attack\u2019s flow\" width=\"688\" height=\"379\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/An-example-of-a-CSRF-attacks-flow.png 688w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/An-example-of-a-CSRF-attacks-flow-300x165.png 300w\" sizes=\"(max-width: 688px) 100vw, 688px\" \/><\/p>\n<p style=\"text-align: center\">Image: An example of a CSRF attack\u2019s flow<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Preconditions for successful Cross-Site Request Forgery (CSRF) attack<\/strong><\/h3>\n<ul>\n<li><strong>A state-changing action<\/strong>: There is a state-changing action within the target applications that the attacker has reason to exploit. It could be any action specific to the user account (such as changing the user&#8217;s password) or a privileged action (like changing permissions for other users).<\/li>\n<li><strong>Cookie-based session management<\/strong>: It relies only on session cookies to identify the user who has generated the state-changing request. There is no other mechanism for validating user requests.<\/li>\n<li><strong>Absence of uncertain request parameters<\/strong>: The request that carries out the action does not contain any parameter of values that the attacker can\u2019t guess or determine. If an attacker needs to know the value of the existing password of the victim when attempting to change the victim\u2019s password via a CSRF attack, then the function is not vulnerable.<\/li>\n<\/ul>\n<h3><strong>A typical Cross-Site Request Forgery (CSRF) attack<\/strong><\/h3>\n<ul>\n<li>The attacker generates a Cross-Site Request Forgery (CSRF) exploits for the vulnerable website and hosts it on a web server under their control.<\/li>\n<li>If a victim visits the attacker&#8217;s web page, the attacker&#8217;s malicious website will trigger an HTTP request to the vulnerable website.<\/li>\n<li>If the user is logged into the vulnerable website, their browser will automatically include their session cookie in the request (unless <a href=\"https:\/\/portswigger.net\/web-security\/csrf\/samesite-cookies\"><em>SameSite cookies<\/em><\/a> are used).<\/li>\n<li>The vulnerable website will process the request as if the victim made it, and execute the state-changing action,e.g., delete their account.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-16892 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-exploit-PoC.png\" alt=\"CSRF exploit PoC - web security vulnerability\" width=\"636\" height=\"360\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-exploit-PoC.png 636w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-exploit-PoC-300x170.png 300w\" sizes=\"(max-width: 636px) 100vw, 636px\" \/><\/p>\n<p style=\"text-align: center\">Image: CSRF exploit PoC<\/p>\n<h2><strong>\u00a0<\/strong><\/h2>\n<h3><strong>Preventing CSRF attacks with tokens<\/strong><\/h3>\n<p>The most tried and tested way to defend against CSRF attacks is the inclusion of CSRF tokens within state-changing requests. A CRSF token is generally created on the server-side of the application which is a secretive and unique value that is later on transmitted to clients via a subsequent HTTP request created by them. When the latter request is created, the server validates the request that includes the expected token, but it rejects the request if the token is missing or invalid.<\/p>\n<p>The tokens help mitigate CSRF attacks by rendering it impossible for an attacker to forge a valid HTTP request suitable for exploiting the victim. As the attacker is not qualified to predict the value of the other user\u2019s token, they won\u2019t be able to generate a request with the required variable for the target application to receive it.<\/p>\n<p>These tokens are considered sensitive information and are managed securely throughout their life-cycle. The most common approach is to transfer the token to the client that is present in the hidden field of HTML form is by submitted it by POST method. It will then include the token as a request parameter when the form is submitted:<\/p>\n<p><em>&lt;input type=&#8221;hidden&#8221; name=&#8221;csrf-token&#8221; value=&#8221;UseinNextRequest_rng123&#8243; \/&gt;<\/em><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-16893 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-token-in-use.png\" alt=\"Cross-Site Request Forgery (CSRF) token in use\" width=\"690\" height=\"389\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-token-in-use.png 690w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-token-in-use-300x169.png 300w\" sizes=\"(max-width: 690px) 100vw, 690px\" \/><\/p>\n<p style=\"text-align: center\">Image: CSRF token in use<\/p>\n<p>Secure implementation of CSRF tokens has the following properties:<\/p>\n<ul>\n<li>Highly randomized and unpredictable.<\/li>\n<li>The token should be mapped to the individual user&#8217;s session.<\/li>\n<li>It should be validated before a relevant or state-changing action is executed.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Common flaws in CSRF token implementation<\/strong><\/h3>\n<h4>Tokens are not mapped to the user\u2019s session<\/h4>\n<ul>\n<li>Some web applications implement a shared pool of tokens and accept any token that appears in this pool.<\/li>\n<li>Validation of the applications is necessary as they clarify that that token belongs to the same session as the request has been made by the same user.<\/li>\n<li>If the tokens are not mapped to the user\u2019s session, the attacker can log in to the application, get a valid token, and pass that token to the victim for exploiting their CSRF.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-16890 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-token-not-mapped-to-a-user-session.png\" alt=\"CSRF token not mapped to a user session\" width=\"643\" height=\"398\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-token-not-mapped-to-a-user-session.png 643w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-token-not-mapped-to-a-user-session-300x186.png 300w\" sizes=\"(max-width: 643px) 100vw, 643px\" \/><\/p>\n<p style=\"text-align: center\">Image: CSRF token not mapped to a user session<\/p>\n<p>&nbsp;<\/p>\n<h4>Token validation relies on the request method<\/h4>\n<p>Consider the following example, where the original request uses the POST method. In this scenario, the server application validates the CSRF token only when the request method is POST.<\/p>\n<p>POST \/email\/change HTTP\/1.1<br \/>\nHost: popular-website.com<br \/>\nContent-Type: application\/x-www-form-urlencoded<br \/>\nCookie: session=rng123xD<\/p>\n<p><a href=\"mailto:csrftoken=UserA_rng123&amp;email=&#x75;&#x73;&#x65;&#x72;&#x5f;&#x61;&#x40;&#x74;&#x65;&#x73;&#x74;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x6c;\">csrftoken=UserA_rng123&amp;email=&#x75;&#x73;&#x65;&#x72;&#x5f;&#x61;&#x40;<span class=\"oe_displaynone\">null<\/span>&#x74;&#x65;&#x73;&#x74;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x6c;<\/a><\/p>\n<p>In this situation, the attacker can change the request to GET method, for bypassing the validation and exploit the CSRF attack:<\/p>\n<p>GET <a href=\"mailto:\/email\/change?email=&#x68;&#x61;&#x63;&#x6b;&#x65;&#x64;&#x40;&#x74;&#x65;&#x73;&#x74;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x6c;\">\/email\/change?email=&#x68;&#x61;&#x63;&#x6b;&#x65;&#x64;&#x40;<span class=\"oe_displaynone\">null<\/span>&#x74;&#x65;&#x73;&#x74;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x6c;<\/a>HTTP\/1.1<br \/>\nHost: popular-website.com<br \/>\nCookie: session= rng456xZ<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Defense in depth with SameSite cookies<\/strong><\/h3>\n<p>CSRF attacks are centered on exploiting the default browser behavior of including a website\u2019s session cookie(s) in cross-site requests. This allows an attacker to forge HTTP request(s) and induces the victim to trigger a sensitive and\/or state-changing action unintentionally.<\/p>\n<p>Most Cross-Site Request Forgery (CSRF) attacks comprise a scenario in which the victim visits the attacker-controlled website and the attacker&#8217;s website triggers a state-changing <a href=\"https:\/\/www.varutra.com\/http-request-smuggling\/\">HTTP request<\/a> to the vulnerable website. How cookies are submitted or whether they are submitted in cross-site requests can be controlled by the SameSiteattribute.<\/p>\n<p>A web application can prevent the default browser behavior of automatically adding cookies to requests by setting the SameSite attribute on session cookies, regardless of the origin of the requests.<\/p>\n<p>The server will issue the cookie when this is included in the Set-Cookie response. Strict or Lax. Are the given two values for the attributes.<\/p>\n<p>Set-Cookie: SessionId=rng_123xD; SameSite=Strict;<\/p>\n<p>Set-Cookie: SessionId= rng_123xD; SameSite=Lax;<\/p>\n<p>The browser will not be including the cookies in any of the requests that are originating from a different site when the setting of the SameSite attribute is Strict. This is the most restrictive option, but it hinders the user experience. The user will not appear to be logged in when the user has used a third-party link to the site and will have to log in again. This scenario occurs when the attribute is set to Strict.<\/p>\n<p>The browser will include cookies in a request that that originates from the other site if the SameSite attribute is configured to Lax, but there are two conditions to be followed:<\/p>\n<ul>\n<li>The request uses the GET method. Cookies will not be included if other methods are used like POST.<\/li>\n<li>When a user generates a result from top-level navigation by clicking a link. Also, cookies will not be included when the other requests are generated by scripts.<\/li>\n<\/ul>\n<p>Using SameSite cookies in Lax mode provides a partial defense against CSRF attacks, considering the hindrance caused because ofStrictSameSite cookies in many scenarios.<\/p>\n<p>Besides <a href=\"https:\/\/portswigger.net\/web-security\/csrf\/tokens\">CSRF tokens<\/a>, these cookies act as an additional defense mechanism that might help mitigate any lapse in implementing CSR tokens. However, it is not recommended to rely solely on SameSite cookies as a defense against CSRF attacks.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>References and further reading<\/strong><\/h3>\n<p>If you would like to delve deeper into this topic, here are a few resources I recommend:<\/p>\n<ol>\n<li><a href=\"https:\/\/portswigger.net\/web-security\/csrf\">https:\/\/portswigger.net\/web-security\/csrf<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/Set-Cookie\/SameSite\">https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/Set-Cookie\/SameSite<\/a><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Author,<\/p>\n<p><strong>Akshay Khilari<\/strong><\/p>\n<p>Attack &amp; PenTest Team<\/p>\n<p>Varutra Consulting Pvt. Ltd.<\/p>","protected":false},"excerpt":{"rendered":"<p>What is Cross-Site Request Forgery (CSRF)? Cross-Site Request Forgery (CSRF) is a widely known web security vulnerability that enables a malicious user to induce another&#8230;<\/p>\n","protected":false},"author":4,"featured_media":16905,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[272],"tags":[493,341,435],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.6.3 - aioseo.com -->\n\t\t<meta name=\"description\" content=\"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.\" \/>\n\t\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t\t<link rel=\"canonical\" href=\"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.6.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Varutra Consulting\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\" \/>\n\t\t<meta property=\"og:description\" content=\"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t\t<meta property=\"article:section\" content=\"Web Application Security\" \/>\n\t\t<meta property=\"article:tag\" content=\"csrf\" \/>\n\t\t<meta property=\"article:tag\" content=\"web application security\" \/>\n\t\t<meta property=\"article:tag\" content=\"web security\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-09-02T07:04:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-02T06:50:17+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"kalpblogger\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#article\",\"name\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\",\"headline\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\",\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/CSRF-Attack.png\",\"width\":1200,\"height\":627,\"caption\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\"},\"datePublished\":\"2021-09-02T12:34:04+05:30\",\"dateModified\":\"2022-12-02T12:20:17+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#webpage\"},\"articleSection\":\"Web Application Security, CSRF, web application security, web security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"nextItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#listItem\"},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#listItem\",\"position\":2,\"name\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\",\"previousItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\",\"name\":\"Varutra\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Varutra-Found-e1612984024606.jpg\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/\",\"name\":\"kalpblogger\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"kalpblogger\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#webpage\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/\",\"name\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\",\"description\":\"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/CSRF-Attack.png\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#mainImage\",\"width\":1200,\"height\":627,\"caption\":\"Mitigating Cross-Site Request Forgery (CSRF) Attacks\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/mitigating-cross-site-request-forgery-csrf-attacks\\\/#mainImage\"},\"datePublished\":\"2021-09-02T12:34:04+05:30\",\"dateModified\":\"2022-12-02T12:20:17+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"name\":\"Varutra Consulting\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Mitigating Cross-Site Request Forgery (CSRF) Attacks<\/title>\n\n","aioseo_head_json":{"title":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","description":"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.","canonical_url":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"og:locale":"en_US","og:site_name":"Varutra Consulting","og:type":"article","og:title":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","og:description":"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.","og:url":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/","og:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","og:image:secure_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","og:image:width":"1200","og:image:height":"627","article:section":"Web Application Security","article:tag":["csrf","web application security","web security"],"article:published_time":"2021-09-02T07:04:04+00:00","article:modified_time":"2022-12-02T06:50:17+00:00","twitter:card":"summary_large_image","twitter:title":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","twitter:description":"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.","twitter:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","twitter:label1":"Written by","twitter:data1":"kalpblogger","twitter:label2":"Est. reading time","twitter:data2":"6 minutes","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#article","name":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","headline":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","width":1200,"height":627,"caption":"Mitigating Cross-Site Request Forgery (CSRF) Attacks"},"datePublished":"2021-09-02T12:34:04+05:30","dateModified":"2022-12-02T12:20:17+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#webpage"},"isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#webpage"},"articleSection":"Web Application Security, CSRF, web application security, web security"},{"@type":"BreadcrumbList","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/#listItem","position":1,"name":"Home","item":"https:\/\/www.varutra.com\/varutravrt3\/","nextItem":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#listItem"},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#listItem","position":2,"name":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","previousItem":"https:\/\/www.varutra.com\/varutravrt3\/#listItem"}]},{"@type":"Organization","@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization","name":"Varutra","url":"https:\/\/www.varutra.com\/varutravrt3\/","logo":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Varutra-Found-e1612984024606.jpg","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#organizationLogo"},"image":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author","url":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/","name":"kalpblogger","image":{"@type":"ImageObject","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g","width":96,"height":96,"caption":"kalpblogger"}},{"@type":"WebPage","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#webpage","url":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/","name":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","description":"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#website"},"breadcrumb":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#breadcrumblist"},"author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"creator":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#mainImage","width":1200,"height":627,"caption":"Mitigating Cross-Site Request Forgery (CSRF) Attacks"},"primaryImageOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/#mainImage"},"datePublished":"2021-09-02T12:34:04+05:30","dateModified":"2022-12-02T12:20:17+05:30"},{"@type":"WebSite","@id":"https:\/\/www.varutra.com\/varutravrt3\/#website","url":"https:\/\/www.varutra.com\/varutravrt3\/","name":"Varutra Consulting","description":"Secure your digital world with our Cybersecurity services.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"}}]}},"aioseo_meta_data":{"post_id":"16888","title":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","description":"Cross-Site Request Forgery (CSRF) is a web security vulnerability. It allows attacker to induce the user to carry out actions that they do not intend to do.","keywords":[],"keyphrases":"{\"focus\":{\"keyphrase\":\"Cross-Site Request Forgery\",\"analysis\":{\"keyphraseInTitle\":{\"title\":\"Focus keyphrase in SEO title\",\"description\":\"Focus keyphrase found in SEO title.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInDescription\":{\"title\":\"Focus keyphrase in meta description\",\"description\":\"Focus keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Focus keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":3},\"keyphraseInURL\":{\"title\":\"Focus keyphrase in URL\",\"description\":\"Focus keyphrase used in the URL.\",\"score\":5,\"maxScore\":5,\"error\":0},\"keyphraseInIntroduction\":{\"title\":\"Focus keyphrase in introduction\",\"description\":\"Your Focus keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInSubHeadings\":{\"title\":\"Focus keyphrase in Subheadings\",\"description\":\"Your H2 and H3 subheadings reflects the topic of your copy. Good job!\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"title\":\"Focus keyphrase in image alt attributes\",\"description\":\"Focus keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}},\"score\":90},\"additional\":[{\"keyphrase\":\"CSRF\",\"score\":100,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":1},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase appears in the first paragraph. Well done!\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}}},{\"keyphrase\":\"web security vulnerability\",\"score\":83,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":3},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}}},{\"keyphrase\":\"security vulnerability\",\"score\":83,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":2},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}}}]}","primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/CSRF-Attack.png","og_image_width":"1200","og_image_height":"627","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Web Application Security","og_article_tags":[],"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"open_ai":null,"created":"2021-10-27 15:11:00","updated":"2022-12-02 06:51:20"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\/category\/web-application-security\/\" title=\"Web Application Security\">Web Application Security<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tMitigating Cross-Site Request Forgery (CSRF) Attacks\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.varutra.com\/varutravrt3"},{"label":"Web Application Security","link":"https:\/\/www.varutra.com\/varutravrt3\/category\/web-application-security\/"},{"label":"Mitigating Cross-Site Request Forgery (CSRF) Attacks","link":"https:\/\/www.varutra.com\/varutravrt3\/mitigating-cross-site-request-forgery-csrf-attacks\/"}],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/16888"}],"collection":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/comments?post=16888"}],"version-history":[{"count":5,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/16888\/revisions"}],"predecessor-version":[{"id":20270,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/16888\/revisions\/20270"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media\/16905"}],"wp:attachment":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media?parent=16888"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/categories?post=16888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/tags?post=16888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}