遇到跨站请求伪造攻击怎么办？
我正在努力防止 CSRF 攻击。我在会话和表单中存储了一个随机值。处理表单时，我比较这两个值。 如果会话和表单值不相等，我应该终止脚本还是有更好的方法来处理这个问题？
I’m trying to prevent CSRF attacks. I’ve stored a random value in the session and in the form. When processing the form, I compare the two values.
If the session and the form value aren’t equal, should I kill the script or is there a better way to handle this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果真实用户不太可能发生这种情况，那么我会阻止脚本保存/返回任何数据，但我会返回“成功”消息，就好像它已经工作一样。如果您返回失败，它可以帮助黑客弄清楚您的验证是如何编码的。
另一方面，如果这种情况发生在真实用户身上，我会返回一个友好错误，并可能要求他们再次登录。
If this is very unlikely to happen from a real user, then I would prevent the script from saving/returning any data, but I would return a 'success' message as if it had worked. If you return a failure, it helps hackers to work out how your validation is coded.
On the other hand, if this happens to real users, I would return a friendly error, and possibly ask them to log in again.
是的。就让它失败吧。恢复此类错误是没有意义的。
然而，您应该做的是编写一个日志条目来审核潜在的利用尝试：
包括一条可读的消息，以防它确实是浏览器错误或其他错误。但不要暴露失败的是 CSRF 令牌。
Yes. Just let it fail. There is no point in recovering such errors.
What you should do however is also write a log entry to audit potential exploit attempts:
Include a humd-readable message in case it was really a browser error or something. But don't expose that it was the CSRF token that failed.