Server-Side CSRF Prevention via Client Certificate Referrer Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for cross-site request forgery (CSRF) prevention, such as white-listing and CSRF tokens, require significant management and modification of applications, and are vulnerable to attacks that submit requests twice, increasing the risk of state-changing vulnerabilities.
Innovation Solution
Implementing a server-level CSRF prevention method using client certificates, where a server request is issued for a user-associated certificate upon a client request to visit a URI, validating the certificate and comparing the referrer listed in the HTTP header with a list of certificate elements to authenticate and authorize the request, thereby preventing CSRF attacks without modifying existing applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-listing solutions are used for CSRF prevention, then CSRF protection is provided, but application modification and registry management complexity increase
Solution Approach 1:
The patent introduces a certificate authority as an intermediary that issues certificates containing white-list information to clients. This mediator eliminates the need for applications to directly manage registries, as the certificate itself contains the authorized referrer information. The server then validates certificates and extracts referrer information from them, removing the complexity of registry management from applications.
2Reliability
If CSRF tokens are used for CSRF prevention, then CSRF protection is provided, but client and server application modification are required
Solution Approach 1:
The patent performs preliminary action by embedding the white-list of authorized referrers directly into the client certificate during the authentication process. This pre-packaging of security information eliminates the need for applications to later generate, pass, or validate CSRF tokens. The certificate itself serves as the preliminary security mechanism that protects against CSRF without requiring application changes.
3Reliability
If current CSRF prevention solutions are implemented, then CSRF protection is provided, but vulnerability to double-submit attacks increases
Solution Approach 1:
The patent applies preliminary anti-action by using digital signatures on certificates to prevent tampering and double-submit attacks. The certificate contains a cryptographic proof of authenticity that the server validates before processing requests. This preliminary security measure ensures that even if an attacker intercepts or resubmits requests, the digital signature validation will detect the tampering or duplication, providing inherent protection against double-submit attacks.
Data Source
AI summary
A computer program product for cross-site request forgery (CSRF) prevention is provided and includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and executable by a processing circuit to cause the processing circuit to issue a server request for a certificate, which is associated with a user, responsive to a client request to visit a uniform resource indicator (URI) being received, validate the certificate upon receipt in fulfillment of the server request, compare a referrer listed in a header of the client request with a list of certificate elements in the certificate, authenticate the user in accordance with correlation between the referrer and at least one of the certificate elements and authorize the client request to visit the URI upon the user being authenticated.