使用javascript进行CSRF保护？
我可以通过使用 javascript 生成 csrf 令牌客户端并使用此令牌从 javascript cookie 设置并将此令牌添加到发布请求来防止 CSRF 吗？
服务器端：检查 cookie[token] === post[token]
Can i protect from CSRF by generating csrf token clien-side with javascript and setting from javascript cookie with this token and adding this token to post request?
server-side: check cookie[token] === post[token]
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不，怎样才能阻止攻击者做同样的事情呢？服务器需要拥有其中一项凭据。
No, what is to stop an attacker from doing the same thing? The server needs to own one of the credentials.
我不相信这会起作用。攻击者可以复制您的算法来生成令牌并发送有效值。您希望在服务器上设置该值并确保该值不能被篡改。
I don't believe this would work. An attacker could just replicate your algorithm for generating the token and send in a valid value. You want to set the value on the server and ensure that the value can not be tampered with.
如果您将 PHP 与 JavaScript 一起使用，那么也许有一种方法可以保护它，请查看 OWASP CSRFGuard 项目，但我没有深入研究它，只是发现了这个
但实际上，我不知道这是否是一个安全的实现...
我知道 OWASP 上的一些人正在努力让 ESAPI 为 JavaScript 做好准备（这就是 Chris Schmidt 在此 Video ) 但我不知道他们现在有多远，看看 esapi.org
If you use PHP with JavaScript, then there is maybe a way to protect it, have a look at the OWASP CSRFGuard Project, but i had not a deep look on it, just found this
But really, i don't know if this is a safe implementation or not...
I know that some people on OWASP are working on getting the ESAPI ready for JavaScript (thats what Chris Schmidt ist talking about in this Video ) but I don't know how far they are at the moment, have a look at esapi.org