Edge Server CSRF Protection via Token Tagging and Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CSRF protection methods are inefficient, particularly when dealing with multiple browser windows or non-HTTPS traffic, and often require significant computational resources at the origin server, while also being vulnerable to token misuse by malicious actors.
Innovation Solution
Implementing token tags at the edge server to indicate when a token is required for resource access or actions, allowing the edge server to generate and validate tokens, cache resources, and provide CSRF protection across HTTP and HTTPS traffic, including JavaScript applications, thereby offloading security checks from the origin server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If token validation is performed at the origin server for each request, then CSRF protection is provided, but the burden on the origin server increases and processing efficiency decreases
Solution Approach 1:
The patent extracts the token validation function from the origin server and relocates it to the edge server. The edge server generates tokens, embeds them in resources, and validates them in incoming requests, thereby removing the security validation burden from the origin server while maintaining CSRF protection.
Solution Approach 2:
The edge server acts as an intermediary between client devices and the origin server. It performs token validation as part of the request processing pipeline before forwarding requests to the origin server, thereby protecting against CSRF attacks without requiring the origin server to perform validation checks.
2Reliability
If cookies are used to store tokens for CSRF protection, then token validation can be performed, but additional security measures are required and the system becomes more complex
Solution Approach 1:
Instead of using cookies to store tokens, the patent embeds tokens directly into the HTML resources (such as hidden form fields or meta tags). This copying approach allows the token to be automatically included in requests without requiring additional client-side scripts or cookie management, simplifying the overall security system.
3Productivity
If CSRF protection is implemented without token tags, then resource caching is limited, but implementing token tags requires modifications to website code
Solution Approach 1:
The edge server automatically detects token tags in resources and performs token generation and validation without requiring manual configuration or modification of the website code. The system self-adapts to the presence of token tags and implements CSRF protection transparently, maintaining ease of website deployment while enabling efficient resource caching.
Data Source
AI summary
An edge server receives a request from a client device to access a resource. The edge server determines whether the requested resource includes a tag within the code of the resource. When the edge server determines there is the tag in the resource, the edge server generates a token, associates the token with the resource (e.g., inserts the token in the code of the resource), and sends the resource to the requesting client device. In response to subsequent requests from the client device for actions to be performed with respect to the resource, the edge server determines whether the action requires a token. When the requested action requires the token, the edge server extracts the token in the request and processes the request after validating the token.