Robust defenses for cross-site request forgery

摘要: Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present new variation on CSRF attacks, login CSRF, in which the attacker forges cross-site request to form, logging victim into honest as attacker. The severity of vulnerability varies by site, but it can be severe scripting We detail three major defense techniques and find shortcomings with each technique. Although HTTP Referer header could provide an effective defense, our experimental observation 283,945 advertisement impressions indicates that blocked at network layer due privacy concerns. Our observations do suggest, however, used today reliable over HTTPS, making particularly well-suited for defending against CSRF. For long term, propose browsers implement Origin header, provides security benefits while responding