X-Requested-With 标头服务器检查是否足以防范 ajax 驱动的应用程序的 CSRF？

发布于 2024-09-11 02:01:19 字数 521 浏览 4 评论 0原文

我正在开发一个完全由 ajax 驱动的应用程序，其中所有请求都通过基本上相当于主控制器的内容，该控制器的基本结构如下所示：

if(strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    fetch($page);
}

这通常足以防止跨站点请求伪造吗？

当整个页面不随每个请求刷新时，使用轮换令牌相当不方便。

我想我可以通过每个请求将唯一令牌作为全局 javascript 变量传递和更新——但不知怎的，这感觉很笨拙，而且似乎本质上不安全。

编辑 - 也许静态令牌（例如用户的 UUID）总比没有好？

编辑 #2 - 正如 The Rook 所指出的，这可能是一个令人吹毛求疵的问题。我读过这两种方式的猜测，并听到远处传言称旧版本的闪存可用于此类恶作剧。由于我对此一无所知，因此我向任何能够解释这是 CSRF 风险的人提供悬赏。否则，我会把它交给Artefacto。谢谢。

原文

I'm working on a completely ajax-driven application where all requests pass through what basically amounts to a main controller which, at its bare bones, looks something like this:

if(strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    fetch($page);
}

Is this generally sufficient to protect against cross-site request forgeries?

It's rather inconvenient to have a rotating token when the entire page isn't refreshed with each request.

I suppose I could pass and update unique token as a global javascript variable with every request -- but somehow that feels clumsy and seems inherently unsafe anyway.

EDIT - Perhaps a static token, like the user's UUID, would be better than nothing?

EDIT #2 - As The Rook pointed out, this might be a hair-splitting question. I've read speculation both ways and heard distant whispers about older versions of flash being exploitable for this kind of shenanigans. Since I know nothing about that, I'm putting up a bounty for anyone who can explain how this is a CSRF risk. Otherwise, I'm giving it to Artefacto. Thanks.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

浅唱ヾ落雨殇 2024-09-18 02:01:19

我想说这就足够了。如果允许跨域请求，那么您无论如何都会失败，因为攻击者可以使用 Javascript 来获取 CSRF 令牌并在伪造的请求中使用它。

静态令牌不是一个好主意。每个会话应至少生成一次令牌。

EDIT2 迈克毕竟不对，抱歉。我没有正确阅读链接到的页面。它说：

一个简单的跨站点请求是：[...]
不使用 HTTP 请求设置自定义标头（例如 X-Modified 等）

因此，如果设置了 X-Requested-With，则该请求必须预先发送，除非您响应如果在飞行前 OPTIONS 请求授权跨站点请求，则该请求将无法通过。

编辑迈克是对的，从 Firefox 3.5 开始，跨站点 XMLHttpRequest 是允许的。因此，您还必须检查 Origin 标头（如果存在）是否与您的网站匹配。

if (array_key_exists('HTTP_ORIGIN', $_SERVER)) {
    if (preg_match('#^https?://myserver.com$#', $_SERVER['HTTP_ORIGIN'])
        doStuff();
}
elseif (array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) &&
        (strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest'))
    doStuff();

I'd say it's enough. If cross-domain requests were permitted, you'd be doomed anyway because the attacker could use Javascript to fetch the CSRF token and use it in the forged request.

A static token is not a great idea. The token should be generated at least once per session.

EDIT2 Mike is not right after all, sorry. I hadn't read the page I linked to properly. It says:

A simple cross-site request is one that: [...]
Does not set custom headers with the HTTP Request (such as X-Modified, etc.)

Therefore, if you set X-Requested-With, the request has to be pre-flown, and unless you respond to pre-flight OPTIONS request authorizing the cross-site request, it won't get through.

EDIT Mike is right, as of Firefox 3.5, cross-site XMLHttpRequests are permitted. Consequently, you also have to check if the Origin header, when it exists, matches your site.

if (array_key_exists('HTTP_ORIGIN', $_SERVER)) {
    if (preg_match('#^https?://myserver.com$#', $_SERVER['HTTP_ORIGIN'])
        doStuff();
}
elseif (array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) &&
        (strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest'))
    doStuff();

回复收藏 0 原文

转身以后 2024-09-18 02:01:19

我不相信这是安全的。同源策略旨在防止来自不同域的文档访问从不同域返回的内容。这就是 XSRF 问题首先存在的原因。一般来说，XSRF 不关心响应。它用于执行特定类型的请求，例如删除操作。
在最简单的形式中，这可以通过正确格式化的 img 标签来完成。您提出的解决方案将阻止这种最简单的形式，但不能保护某人使用 XMLHttp 对象发出请求。
您需要使用 XSRF 的标准预防技术。我喜欢在 javascript 中生成一个随机数并将其添加到 cookie 和表单变量中。这确保代码也可以为该域写入 cookie。如果您想了解更多信息，请参阅此条目。

另外，为了抢占有关 XMLHttp 在脚本中不起作用的评论。我在 Firefox 3.5 中使用了以下代码，从本地主机域中运行的 html 向 google 发出请求。内容不会返回，但是使用firebug，可以看到发出了请求。

<script>
var xmlhttp = false; 

if (!xmlhttp && typeof XMLHttpRequest != 'undefined') {
    try {
        xmlhttp = new XMLHttpRequest();
    } catch (e) {
        xmlhttp = false;
    }
}
if (!xmlhttp && window.createRequest) {
    try {
        xmlhttp = window.createRequest();
    } catch (e) {
        xmlhttp = false;
    }
}

xmlhttp.open("GET", "http://www.google.com", true);
xmlhttp.onreadystatechange = function() {
    if (xmlhttp.readyState == 4) {
        alert("Got Response");
        alert(xmlhttp.responseText)
    }
}

xmlhttp.send(null)
alert("test Complete");

I do not believe that this is safe. The same origin policies are designed to prevent the documents from different domains from accessing the content that is returned from a different domain. This is why XSRF problems exist in the first place. In general XSRF doesn't care about the response. It is used to execute a specific type of request, like a delete action.
In the simplest form, this can be done with a properly formatted img tag. Your proposed solution would prevent this simplest form, but doesn't protect someone from using the XMLHttp object to make the request.
You need to use the standard prevention techniques for XSRF. I like to generate a random number in javascript and add it to the cookie and a form variable. This makes sure that the code can also write cookies for that domain. If you want more information please see this entry.

Also, to pre-empt the comments about XMLHttp not working in script. I used the following code with firefox 3.5 to make a request to google from html running in the localhost domain. The content will not be returned, but using firebug, you can see that the request is made.

<script>
var xmlhttp = false; 

if (!xmlhttp && typeof XMLHttpRequest != 'undefined') {
    try {
        xmlhttp = new XMLHttpRequest();
    } catch (e) {
        xmlhttp = false;
    }
}
if (!xmlhttp && window.createRequest) {
    try {
        xmlhttp = window.createRequest();
    } catch (e) {
        xmlhttp = false;
    }
}

xmlhttp.open("GET", "http://www.google.com", true);
xmlhttp.onreadystatechange = function() {
    if (xmlhttp.readyState == 4) {
        alert("Got Response");
        alert(xmlhttp.responseText)
    }
}

xmlhttp.send(null)
alert("test Complete");

回复收藏 0 原文