Cookie-Based CSRF and Clickjacking Protection via Transaction Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing Cross-Site Request Forgery (CSRF) and Clickjacking attacks are inadequate, as they can be bypassed by attackers using IFRAMEs and require browser configuration to run embedded JavaScript routines, leaving unconfigured browsers vulnerable.
Innovation Solution
A system that includes configuring web pages with instructions to create a cookie representing transaction data, which is validated against predefined criteria before allowing transactions, ensuring the cookie is present and valid to prevent unauthorized actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If embedded JavaScript instructions are used to detect IFRAME context, then Clickjacking protection is improved, but browser compatibility deteriorates because unconfigured browsers remain vulnerable
Solution Approach 1:
The patent introduces a cookie as an intermediary mechanism that mediates between the server and client to provide Clickjacking protection. The server sets a cookie containing transaction data, and the client returns this cookie with requests. This intermediary approach allows protection without requiring complex browser configurations or JavaScript execution, thus maintaining broad browser compatibility while still providing reliable Clickjacking detection.
Solution Approach 2:
The patent replaces the mechanical system of embedded JavaScript instructions with a simpler cookie-based validation mechanism. Instead of relying on browser-executable code to detect IFRAME context, the system uses server-set cookies and server-side validation logic. This substitution eliminates the need for browser configuration while maintaining protection effectiveness.
2Reliability
If nonce-based protection is used to prevent CSRF attacks, then transaction security is improved, but the system becomes vulnerable to Clickjacking attacks
Solution Approach 1:
The patent merges CSRF protection and Clickjacking protection into a single unified mechanism. By combining the nonce concept with cookie-based validation, the system achieves both protections simultaneously. The cookie contains transaction data that must match server-side expectations, preventing both unauthorized CSRF requests and Clickjacking attacks where the user is tricked into submitting requests.
Solution Approach 2:
The patent creates a composite security mechanism that combines multiple protection concepts (nonce, cookie, transaction data validation) into a single robust system. This composite approach integrates the strengths of different protection methods while eliminating their individual weaknesses, providing comprehensive security against both CSRF and Clickjacking attacks.
3Reliability
If browser configuration is required to run security instructions, then security effectiveness is improved, but ease of operation deteriorates due to configuration requirements
Solution Approach 1:
The patent implements a self-service security mechanism where the server automatically sets and manages the protective cookies without requiring any client-side configuration or user action. The server includes the cookie-setting instructions in the web page content, and the browser automatically handles cookie storage and transmission. This eliminates the need for users to configure their browsers while maintaining security effectiveness.
Data Source
AI summary
Embodiments of the invention generally relate to thwarting fraud perpetrated with a computer by receiving a request from a computer to perform a transaction. Embodiments of the invention may include receiving the request together with transaction data and a cookie, where the transaction data are separate from the cookie; determining in accordance with predefined validation criteria whether the cookie includes a valid representation of the transaction data; and performing the transaction only if the cookie includes a valid representation of the transaction data.