Patent ID: 8020193
Filing Date: 2011-09-13
Classification: G06F,H04L

Abstract:
1. A computer implemented method for protecting web based applications from Cross Site Request Forgery (CSRF) attacks, comprising the acts of: classifying each of a plurality of first resources offered by a web server application as a CSRF-protected resource or a not-CSRF-protected resource; performing at least a portion of a user authentication process by verifying a user's identity using authentication information received at a server computer; initializing an authentication-token to be validated by said server computer, said authentication-token identifying a user and signifying permission to access certain resources of said plurality of first resources; initializing a CSRF protection secret to be used to validate a proof of possession of said CSRF protection secret contained in a first resource identifier or a first resource header for at least one resource of said plurality of first resources; receiving a first request for said resource at said server computer, said first request including (a) said authentication-token and (b) said CSRF protection secret or a message generated using said CSRF protection secret; in response to receiving said first request, determining which content of said resource references CSRF-protected resources; modifying said content of said resource, which was determined to reference CSRF-protected resources, to include a CSFR protected parameter that is to be validated against said CSRF protection secret included in a second request for a CSRF-protected resource referenced by said content or used to generate said message included in said second request.