A web page request security processing method and system

Abstract

The embodiment of the invention discloses a webpage request safe processing method and a webpage request safe processing system; the method comprises the following steps that: the current webpage on a browser side constructs the encrypted log-in information of the current webpage; the browser side sends the webpage request of the current webpage; the webpage request comprises the encrypted log-in information of the current webpage and the log-in information of the current webpage that a browser adds; a server side receives the webpage request, and matches the encrypted log-in information of the current webpage in the webpage request with the log-in information of the current webpage that the browser adds after encryption; if the matching result is inconsistent, the webpage request is interrupted; and if the matching result is consistent, the webpage request is normally responded to. After the invention is adopted, the identification and the prevention to cross-site request forgery (CRSF) attack are realized when the reform to the whole system is small.

Description

technical field [0001] The invention relates to the field of Internet security, in particular to a method and system for safely processing webpage requests. Background technique [0002] Information security in the Internet has always been a very important issue in this field. Among them, CSRF (Cross-site request forgery, cross-site request forgery) is a common technology that steals user information through malicious use of web pages. This technology is also called "oneclick attack" or "sessionriding". Abbreviated as XSRF. [0003] CSRF uses the login status of the user on the logged-in website A to perform operations that require login verification on the A website through http (HyperTextTransferProtocol, hypertext transfer protocol) requests (hidden pictures or script references) on the page of the B website , so as to achieve the purpose of attacking or stealing private information. This is especially common in multi-window browsers. [0004] Due to the characteristi...

AI Technical Summary

Problems solved by technology

[0012] However, the above three methods have their own limitations:

[0013] (1) High labor costs and passiveness: developers need to continuously follow up and repair the discovered vulnerabilities; it is impossible to guarantee that all CSRF vulnerabilities can be discovered and resolved in time; and it is impossible to prevent the emergence of new CSRF vulnerabilities in subsequent development;

[0014] (2) High development cost: the development of the same function requires more complex design schemes, and is not suitable for static web pages;

[0015] (3) Poor security and high development costs: attackers can simulate post requests in various ways; if it needs to be deployed on an already mature website, a lot of resources need to be invested in code adjustments

Images