Method and system for preventing cross-site request forgery attack

Abstract

The invention is applicable for the technical field of network safety, and provides a method and a system for preventing a cross-site request forgery attack. The method comprises the steps that: a client generates an HTTP request when page information of a browser is received; the client performs filtration treatment on cookie information in the HTTP request based on a strategy document obtained from a server-side; the client sends the HTTP request after subjected to the filtration treatment to the server-side. In the method and the system for preventing the cross-site request forgery attack, the strategy document is provided by the server-side, the server-side defines requests from which pages the service-side expects to receive exactly, and the client performs authenticity judgment on the HTTP request based on the strategy document, so that requests which are not allowed by the strategy document are guaranteed to not carry cookie of a user, requests which the server-side does not expect to receive cannot be sent by the client, and the network safety of the client is guaranteed.

Description

technical field [0001] The invention relates to network security, mainly to browser security and web application security, and in particular to a method and system for preventing cross-site request forgery attacks. Background technique [0002] In the prior art, the communication between the website server and the user client is mainly through the HTTP (HyperTextTransferProtocol, hypertext transfer protocol) protocol. According to the definition of the HTTP protocol, the protocol is a stateless protocol, that is, each communication between the server and the client is independent of each other, and the next communication between the server and the client does not know the information of the previous communication. However, in practical applications, continuous and stateful communication between the server and the client is required, so cookie technology is introduced as one of the most common solutions. [0003] In order to maintain a stateful connection between the server ...

AI Technical Summary

Problems solved by technology

[0005] In the prior art, this defect is caused by the inappropriate definition of the responsibility for verifying the user's request, and the prior art only allows the client or the server to judge the authenticity of the request, but the client cannot know a request from a certain page. Whether the request to another page is what the server expects, and the server cannot know the context in which the request from the client is generated, which cannot effectively prevent CSRF attacks

[0006] In summary, there are obviously inconveniences and defects in the actual use of the existing technology, so it is necessary to improve

Images