CSRF保护和跨站表单访问
我正在研究跨站点身份验证（某些域具有通用身份验证）。所以我想将身份验证数据（登录名、密码）从其他人发送到主域。
我应该如何使用 protect_from_forgery 以及如何检查数据是否来自有效域？
我现在的想法是关闭会话控制器的 protect_from_forgery 并检查接收到的数据的域名。
但也许我不仅可以为一个域配置 CSRF 保护？
I aw working on cross site authentication (some domains have got common authentication). So I want to send authentication data (login, password) to main domain from others.
How should I use protect_from_forgery and how can I check if data received from valid domain?
What I am thinking now is to turn off protect_from_forgery for session controller and check domain name of received data.
But maybe I can configure CSRF protection for not only one domain?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
保护通过检查会话 [:_csrf_token] 来进行，因此如果您的会话在所有域中都相同，则 protected_from_forgery 可以起作用。
The protection work with checking the session[:_csrf_token], so if you session is same in all of your domain, the protect_from_forgery can works.
您的目的是 CSRF 漏洞的定义。强制用户登录或注销通常对攻击者没有用。要完成此黑客攻击，攻击者必须知道用户名和密码，这违背了“会话骑乘”另一个用户的经过身份验证的会话的目的。作为一名编写 CSRF 漏洞 的铁杆黑客，我告诉您这不是一个严重的问题。
修补此问题的一个简单方法是检查引荐来源网址并确保登录请求源自域白名单。修补此问题的另一种方法是使用像 reCapthca 这样的 Capthca。是的，你没看错。之所以有效，是因为攻击者无法使用 javascript 或 flash 解析 capthca 来“伪造”有效的登录请求。
What you are purposing is the very definition of a CSRF vulnerability. Forcing the user to Login or log-off generally isn't useful to the attacker. To pull off this hack the attacker would have to know the Username and Password, which defeats the purpose of "Session riding" on another user's authenticated session. As a hardcore hacker that writes CSRF exploits I'm telling you that this isn't a serious problem.
A easy way to patch this is to check the referer and make sure the login request is originating from a whitelist of domains. Another way to patch this is to use a Capthca like reCapthca. Yes you read that right. The reason why this works is because an attacker cannot solve the capthca with javascript or flash to "forge" a valid login request.