Server-Side XSRF Validation Using MAC Tokens and Enciphered Forms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications are vulnerable to Cross-Site Request Forgery (XSRF) attacks, where attackers can trick authorized users into submitting malicious requests, leading to undetectable and unintended actions, undermining trust in web commerce.
Innovation Solution
A server-side solution involving the generation of user and request identifier tokens, along with timestamps, to form a Message Authentication Code (MAC) that is used to validate requests, including enciphering form element names, adding fake form elements, and encrypting the entire page, to ensure intentional user actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a client-side fix is instituted to prevent XSRF attacks, then security against XSRF attacks is improved, but device complexity and scalability deteriorate because every vulnerable browser would need to be replaced
Solution Approach 1:
The patent introduces a server-side intermediary mechanism that mediates between the client browser and the web application. The server validates requests by checking tokens and timestamps before processing, acting as a security gatekeeper that protects against XSRF attacks without requiring client-side modifications or browser replacements.
2Reliability
If a server-side fix is implemented to prevent XSRF attacks, then security against XSRF attacks is improved, but device complexity increases due to substantial modification requirements for vulnerable web applications
Solution Approach 1:
The patent implements preliminary action by pre-generating secure tokens and timestamps on the server side before the actual request processing. These pre-computed security elements are embedded in the HTML forms, allowing the server to validate requests without requiring complex real-time computations or extensive modifications to the web application logic during request handling.
3Reliability
If token and timestamp validation is performed to ensure intentional user actions, then reliability against unauthorized requests is improved, but processing time increases due to additional validation steps
Solution Approach 1:
The patent uses disposable, short-lived tokens and timestamps that are generated for each request and invalidated after use. These lightweight security elements require minimal processing power and storage, enabling rapid validation without significantly increasing request processing time. The tokens are designed to be computationally inexpensive to generate and verify.
Data Source
AI summary
An apparatus and a method for validating requests to thwart cross-site attacks is described. A user identifier token, a request identifier token, and a timestamp, are generated at a web application of a server. A Message Authentication Code (MAC) value is formed based on the user identifier token, the request identifier token, and the timestamp using a secret key of the web application. Names of the form elements are enciphered. Fake form elements can also be added to the dynamic form. The entire page also can be enciphered. The dynamic form is sent with the MAC value and the time stamp to a client. A completed form comprising a returned MAC value and a returned timestamp is received from the client. The completed form is validated at the server based on the returned MAC value and the returned timestamp.