Method and system for preventing cross-site attack

Abstract

Efficient cross-site attack prevention, in which web pages are stored on a site, the web pages being organized into entry pages that do not accept input, and protected pages that are not entry pages. A request is received from a user application to receive a requested web page, the request including a referrer string indicative of a referring web page, and identification data. It is determined whether the requested web page is an entry page or a protected page, and it is further determined, if the requested web page is determined to be a protected page, if the user application is authorized based upon the identification data, and if the referring web page is stored on the site based upon the referrer string.; The requested web page is transmitted to the user application if the user application is determined to be authorized and if the referring web page is determined to be stored on the site, and the request is redirected to an entry page if the user application is determined to be not authorized or if the referring web page is determined to be not stored on the site.

Description

Method and system for preventing cross-site attacks technical field The present invention relates generally to protection against cross-site attacks, and at least one particular embodiment relates to protection against cross-site scripting and cross-site request forgery attacks. Background technique While web applications operate in virtual environments, some of them, including online auctions or banking applications, involve real-world currency transactions. Both web users and websites have a vested interest in securing these currency transactions, which provides an attractive target for hackers to manipulate. Malicious exploitation of key weaknesses in these security-critical web applications is continually being developed, with cross-site scripting and cross-site request forgery attacks particularly favored by hackers. The vanguard of these attacks are malicious links, infected with scripts or forged input, which are presented to legitimate users via electronic commun...

AI Technical Summary

Problems solved by technology

While traditional client-side and server-side techniques exist to protect against cross-site attacks, these solutions are often imperfect

For example, some of these typical schemes only target session theft attacks, which attack the integrity of the session

Images