Patent ID: 8893270

Claim:
A computer-implemented method of detecting a cross-site request forgery (CSRF) attack, the method comprising: receiving an HTTP (Hypertext Transfer Protocol) response from a website, the HTTP response being responsive to a request for a web page previously submitted from a user computer to the website; analyzing the HTTP response for presence of CSRF code by determining whether a type of content expected to be received by a web browser running in the user computer is consistent with content that will be provided to the web browser, the CSRF code comprising computer-readable program code which automatically accesses an online account of a user of the user computer upon receipt and execution of the CSRF code in the user computer without authorization from the user; performing a security action when the CSRF code is found in the HTTP response; receiving an HTTP request from the web browser; analyzing the HTTP request for information indicative of a CSRF attack; and performing the security action when the HTTP request includes information indicative of the CSRF attack.