Skip to main content
Version: 6.14.0

Cross-Site Request Forgery (CSRF)

CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.  The victim, authenticated to a website, is unknowingly tricked into performing an action on that website.

Overview​

As an example, an attacker could email victim@vmail.com which contains a link.  When the victim clicks on the link, the webpage that loads up can trick the victims browser into going to vmail.com's change password form and changing the password, all invisibly to the victim.  As the attacker cannot see the results of the exploit, the exploit rarely results directly in data theft and more commonly results in the unwitting execution of an action.  This could also do things like trick a victim into transferring money if the attack involves a bank website and if they are logged into the site as administrator, then the entire site can be compromised.

Rule Options​

CSRF protection​

Same origin headers - When an HTTP request is received by your application, RASP Java Agent will perform Same Origin validation by matching the request's source origin headers against the allowed hosts and the request's target origin headers. If there is no match then RASP Java Agent will consider the request as malicious and will strip out all HTTP parameter and HTTP cookie information from the request before allowing the request to be processed by the application. Synchronized tokens - When an HTTP request is received by your application, RASP Java Agent will perform Synchronized Token validation by matching the victim's POSTed token to the token on the server.

Same-Origin Options​

Screenshot of the Same-Origin Options settings in the CSRF Rules Wizard

HTTP endpoint (optional)​

Here the user may enter in a list of relative URIs to be protected, monitored, or whitelisted.  A relative URI only includes the path portion of the URL, and not the domain.  For example if the website address was http://www.victim.com/home/test.html, then /home/test.html is the relative URI or HTTP endpoint.

The path within the relative URI must be absolute and begin with a leading /. In the above example /home/test.html is valid, and home/text.html is not. In addition relative paths may not contain .. or other similar characters denoting path shortcuts. For example, /home/test/user/test.html is valid, but ../test/user/test.html is not.

Excluded/whitelisted relative URIs - leave blank for no exclusions (optional)​

For ARMR versions 2.6 and above, a list of relative URIs to be excluded from this rule's protection can be entered here. Leaving it blank adds no exclusions. Validation follows the same format as described under the HTTP endpoint (optional) section above.

Excluded/whitelisted hosts​

A list of FQDNs or IP addresses and optionally ports to be excluded from this rule's protection.  An empty list means none will be whitelisted. Only single port values are accepted, not ranges. This defaults to an empty list.

A single CSRF Rule may apply to many different addresses. When you enter an IP address or FQDN and port in the Excluded/whitelisted FQDNs or IP addresses (optional) and Port (optional) fields and click on the Add button, a table with the columns FQDN/IP address, Port (optional) and Actions will appear under the fields (provided it is not already showing) and the entry will be displayed in the table. Entries in the table may be deleted or edited in place, using the table's actions.

  • IP addresses must be v4. Fully Qualified Domain Names (FQDN) may be used here as well.
  • An IP Address value of “0.0.0.0” indicates a wildcard value of Any IP address.
  • A Port value of “0” or blank indicates a wildcard value of any port

Synchronized Tokens Options​

Rules Wizard Synchronized Tokens Options for the Cross-Site Request Forgery rule

HTTP endpoint (optional)​

Prior to RASP Java Agent version 25.5.0, it is not possible to target specific HTTP endpoints for CSRF synchronized-tokens ARMR rules, and protection/detection/monitoring is enabled for all HTTP endpoints. In RASP Java Agent version 25.5.0+ (and for ARMR versions 2.6 and above), specific HTTP endpoints can optionally be targeted using the paths key in the same way as the same-origin CSRF rule described above.

Method value​

The options are POST and GET.  POST is selected by default.  At least one option must be selected, and both options may also be selected.  No selection will result in an error.

Ajax requests (optional)​

The only available option is the Validate requests checkbox. It is unchecked by default; check it to validate Ajax requests.

  • Token values - The options here are Shared token and Unique token (default).
  • Token name - The default token name is  _X-CSRF-TOKEN and filled in by default.  You may fill in your own value.  A blank field will result in an error.

Excluded/whitelisted relative URIs - leave blank for no exclusions (optional)​

A list of relative URIs to be excluded from this rule's protection. This is a list of exclusions, so if no exclusions are configured, all requests will be validated. Validation follows the same format as described under the HTTP endpoint (optional) section of the Same-Origin options above.

Action​

  • Detect - The Agent will detect the lookup of listed address(es) and generate Security Event which will be viewable on the Security Events page in the Portal, but the Agent will take no further action.
  • Protect - In addition to the Detect actions, request will be stopped.

For each of the CSRF Synchronized tokens and Same origin headers options, the Agent only allows one rule to be specified.