Shulou(Shulou.com)06/02 Report--

This article mainly introduces "what is the principle of csrf attack". In daily operation, I believe that many people have doubts about the principle of csrf attack. The editor consulted all kinds of materials and sorted out simple and easy-to-use operation methods. I hope it will be helpful for you to answer the doubts about "what is the principle of csrf attack?" Next, please follow the editor to study!

What is the principle of 1 csrf attack? When you gain the trust of website A, visit website B, which contains a disguised request to visit A, so that you can take the cookie of website A to visit the background of A.

2 cross-domain can not access cookie, why can you carry the cookie of A website in B website. You can edit the crc property of the picture into a request to visit the A website. Since you are visiting website A, it is natural to carry the cookie of website A.

3 how to prevent it? The request header of http has a reffer attribute, which represents the source of the request, that is, the website from which the request was initiated. The background verifies whether the request comes from website A, and if not, intercepts the request. It works in most cases, but some older browsers, such as earlier versions of ie, are said to be able to modify reffer, and some other technologies seem to modify new browsers as well.

4 another way is token verification. After a successful login, the server generates a random token to the browser. The browser carries the token when submitting the form, verifies in the background whether the token is the same as that given to the browser, and intercepts it if it is different.

5 note that this token cannot be stored in cookie, because the csrf attack is to swindle your cookie, and the work in cookie is in vain. The way you can think of is to store it in the global variable of js.

At this point, the study of "what is the principle of csrf attack" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.