Patent ID: 8997222
Filing Date: 2015-03-31
Classification: G06F,H04L

Abstract:
1. A method for preventing a Cross-Site Request Forgery (CSRF) attack, the method comprising: intercepting one or more requests sent from a client browser to an authentication module of a server to access a first protected resource at a first Universal Resource Locator (URL), wherein in response to receiving the one or more requests, the authentication module issues a prompt for authentication information associated with a user; generating a token; recording the token as a recorded token; generating a response to the one or more requests; inserting the recorded token into the first URL within the response to the one or more requests; sending the response to the one or more requests to the client browser with the recorded token inserted in the response; in response to sending the response to the one or more requests to the client browser and the client browser receiving the response to the one or more requests, intercepting a subsequent request that is sent from the client browser to the server, wherein the subsequent request comprises a request to access the first protected resource at the first URL; in response to intercepting the subsequent request: in response to the client browser receiving the first protected resource at the first URL, intercepting a secondary request to access a second protected resource at a second URL, wherein the secondary request is initiated by selecting the second URL within a page corresponding to the first URL, wherein the secondary request to access the second protected resource at the second URL further comprises a GET request to the second URL and a referer header that contains the first URL and a secondary token inserted within the address of the page corresponding to the first URL.