Published on

Cross-Site Request Forgery (CSRF)

Authors

Table of Contents:

Introduction

In today's interconnected world, web applications have become an integral part of our daily lives. From online banking to social media platforms, we rely on web applications to perform various tasks. However, with the increasing complexity and sophistication of web applications, ensuring their security has become a paramount concern.

One of the vulnerabilities that web developers need to be aware of is Cross-Site Request Forgery (CSRF). In this article, we will explore the fundamentals of CSRF attacks, understand how they can compromise the security of web applications, and learn effective measures to prevent them.

Understanding Cross-Site Request Forgery (CSRF)

What is CSRF?

Cross-Site Request Forgery (CSRF) is a type of attack where an attacker tricks a user into performing unwanted actions on a web application in which they are authenticated. This attack occurs when a malicious website or email containing a specially crafted request forces the victim's browser to make a request to the target website, exploiting the victim's authentication credentials.

How Does CSRF Work?

To understand how CSRF attacks work, let's consider a simple scenario. Suppose Alice is logged into her favorite online shopping website, and she receives an email from an attacker. The email contains a link that appears to be harmless but actually triggers a request to the online shopping website. If Alice clicks on the link, her browser automatically sends the request with her authentication cookies, leading the website to execute the request as if it were initiated by Alice herself.

This means that if the attacker crafts a malicious request to perform an action like changing Alice's password or making a purchase, the website will process it, considering it a legitimate request from Alice.

Preventing CSRF Attacks

Preventing CSRF attacks requires implementing proper security measures in web applications. Let's explore some effective techniques to mitigate CSRF vulnerabilities.

CSRF Tokens

One of the widely adopted methods to prevent CSRF attacks is by using CSRF tokens. A CSRF token is a unique value generated for each user session and included as an additional parameter in every state-changing request. The server validates the CSRF token with each request, ensuring that it matches the value stored in the user's session. This way, if an attacker tries to forge a request, they won't have the valid CSRF token required for successful validation.

To implement CSRF tokens in a web application, follow these steps:

  1. Generate a CSRF token for each user session.
  2. Include the CSRF token in all state-changing requests, such as form submissions or AJAX requests.
  3. On the server-side, validate the received CSRF token against the value stored in the user's session.

Here's an example of generating and validating CSRF tokens in TypeScript:

// Generating a CSRF token
import { randomBytes } from 'crypto'

const generateCSRFToken = () => {
  return randomBytes(16).toString('hex')
}

// Validating CSRF tokens
app.post('/submit', (req, res) => {
  const { csrfToken } = req.body
  const sessionCSRFToken = req.session.csrfToken

  if (csrfToken === sessionCSRFToken) {
    // Proceed with processing the request
  } else {
    // Reject the request as a potential CSRF attack
  }
})

SameSite Cookies

Another effective measure to prevent CSRF attacks is by setting the SameSite attribute for cookies. The SameSite attribute defines how cookies should behave when making cross-site requests. By setting the SameSite attribute to Strict, cookies will only be sent along with requests originating from the same site. This prevents browsers from automatically including cookies when processing requests triggered by external websites, effectively mitigating CSRF attacks.

To set the SameSite attribute for cookies, you can use the following code snippet in your backend application:

// Setting the SameSite attribute for cookies
app.use((req, res, next) => {
  res.cookie('session', req.session, {
    sameSite: 'strict',
  })
  next()
})

Double Submit Cookies

The double submit cookies technique involves sending two cookies with each request: an authentication cookie and a separate CSRF token cookie. The server then compares the values of these two cookies to validate the authenticity of the request. If the values match, the server considers the request valid and proceeds with processing it.

To implement the double submit cookies technique, follow these steps:

  1. Generate a CSRF token for each user session and store it in the user's session data.
  2. Include the CSRF token as a separate cookie in each request.
  3. On the server-side, compare the values of the CSRF token cookie and the authentication cookie to validate the request.

Here's an example of implementing double submit cookies in TypeScript:

// Generating a CSRF token
import { randomBytes } from 'crypto'

const generateCSRFToken = () => {
  return randomBytes(16).toString('hex')
}

// Include CSRF token as a separate cookie
app.use((req, res, next) => {
  const csrfToken = generateCSRFToken()
  res.cookie('csrfToken', csrfToken, { httpOnly: true })
  req.session.csrfToken = csrfToken
  next()
})

// Validate CSRF token against the authentication cookie
app.post('/submit', (req, res) => {
  const { csrfToken } = req.cookies
  const sessionCSRFToken = req.session.csrfToken

  if (csrfToken === sessionCSRFToken) {
    // Proceed with processing the request
  } else {
    // Reject the request as a potential CSRF attack
  }
})

Conclusion

Cross-Site Request Forgery (CSRF) attacks can have severe consequences for web applications and their users. By understanding how CSRF attacks work and implementing preventive measures such as CSRF tokens, SameSite cookies, and double submit cookies, we can significantly reduce the risk of CSRF vulnerabilities.

Remember, web security is an ongoing effort, and it's crucial to stay updated with the latest security best practices. Regularly audit your web applications for potential vulnerabilities and keep an eye on emerging threats in the web security landscape.

Resources

  1. OWASP CSRF Prevention Cheat Sheet
  2. MDN Web Security Documentation on CSRF
  3. OWASP Top Ten Project