Browser Extension CSRF Defense via Local Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing defenses against cross-site request forgery (CSRF) suffer from token leakage, compatibility issues with web frameworks, and varying accuracy in client-side heuristics, leading to false positives and negatives.
Innovation Solution
A computer security method that involves detecting requests before transmission and enforcing Authorization Acceptance Criteria (AAC) configured by the web server, which includes security requirements such as cookie management, request source validation, and CSRF security elements to ensure only authorized requests are processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If server-side security tokens are embedded in web pages, then CSRF protection is provided, but token leakage and compatibility issues with web frameworks occur
Solution Approach 1:
A browser extension acts as an intermediary between the user's browser and web servers. The extension intercepts outgoing requests, validates security tokens locally, and determines whether to allow or block requests based on predefined security policies, eliminating the need for complex server-side token management while maintaining strong CSRF protection
Solution Approach 2:
The system enables self-service security validation by storing security tokens locally in the browser and using browser-based heuristics to automatically determine request safety. This shifts the security validation burden from the server to the client, simplifying server-side implementation while maintaining protection
2Reliability
If client-side browser plugins with heuristics are used, then CSRF detection is improved, but false positives and false negatives increase
Solution Approach 1:
Security tokens and authorization acceptance criteria are pre-configured and stored in the browser before any requests are made. The browser extension uses these pre-stored security parameters to validate requests, improving detection accuracy by having security information ready in advance rather than determining safety dynamically without context
Solution Approach 2:
The system implements feedback mechanisms where the browser extension learns from user decisions about blocked or allowed requests. User corrections to false positives or negatives feed back into the security policy configuration, continuously improving the accuracy of request safety determination over time
3Reliability
If traditional server-side token validation is implemented, then security is improved, but ease of operation and compatibility across web frameworks deteriorate
Solution Approach 1:
The browser extension automatically manages security tokens, stores authorization acceptance criteria locally, and performs validation without requiring server-side configuration changes. This self-service approach maintains strong security while eliminating the operational burden of configuring and maintaining security tokens across different web frameworks and pages
Data Source
AI summary
A computer security method including detecting a request, made by a computer software application, prior to transmission of the request to a recipient, accessing a predefined security requirement associated with the recipient, determining whether the predefined security requirement is met, and preventing at least a portion of the request from being transmitted to the recipient if the predefined security requirement is not met.