Cross-site request forgery

As explained in Spring Security in Action, Second Edition

Cross-site request forgery is an attack that causes a user's authenticated browser to send an unintended state-changing request to a web application.

Cross-site request forgery (CSRF) tricks a user who is already authenticated into opening a page whose scripts perform unwanted state-changing actions in the trusted application. A foreign page can therefore impersonate the user through the user's existing login. section 9.1

Spring Security enables CSRF protection by default. It generates a CSRF token when a page loads, and clients must include that token in requests that change application state, such as HTTP POST requests. section 9.0 section 9.1

The Spring Security implementation connects the protection mechanism to the filter chain:

• CsrfFilter receives requests and uses a CsrfTokenRepository to manage CSRF tokens. section 9.1
• The filter places the token on the request under the _csrf attribute, making it available to application code. section 9.1
• A request without the expected token is rejected with HTTP 403, while a request carrying the session cookie and X-CSRF-TOKEN succeeds. section 9.1
• Customization is organized around CsrfToken, CsrfTokenRepository, and CsrfTokenRequestHandler. section 9.4

Testing a protected REST endpoint

A small REST application exposes GET and POST endpoints at /hello. Calling GET first establishes the session and exposes a token. Calling POST without the token returns 403; repeating POST with the JSESSIONID cookie and X-CSRF-TOKEN header returns the endpoint response. section 9.1

Figure 9.1 After the user logs into their account, they access a page containing forgery code. This code impersonates the user and can execute unwanted actions on behalf of the user.

Visualizes how forgery code on a page accessed after authentication can execute unwanted actions for the user. section 9.1

Figure 9.2 To make a POST request, the client needs to add a header containing the CSRF token. The application generates a CSRF token when the page is loaded (via a GET request), and the token is added to all requests that can be made from the loaded page. This way, only the loaded page can make mutating requests.

Shows the page-load token flow and the required header for mutating requests. section 9.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains the attack, token flow, filter integration, request testing, and extension contracts, while stopping short of broader attack theory.

Examples

Uses a file-management attack scenario, a Spring REST /hello endpoint, custom token logging, and curl requests.

What it assumes

Assumes familiarity with Spring Security's filter chain and HTTP endpoints while building the CSRF attack and token mechanism explicitly.

What you can do after

Operate/configure Spring Security protection, test token-protected POST requests, and customize token handling through named contracts.

How it connects

Connects authentication, HTTP filters, filter chains, REST endpoints, HTTP POST, session cookies, and CSRF tokens.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eCross-site request forgery (CSRF) is an attack in which a victim's authenticated browser is induced to submit an unintended request to a trusted application.
• 

  liveBookmanning.com
  Grokking Web Application SecurityCross-site request forgery is a web attack that causes a user's browser to send an unintended authenticated request to a site.
• 

  liveBookmanning.com
  Django in ActionCross-site request forgery is a web attack that tricks an authenticated user’s browser into submitting an unintended state-changing request to a site.
• 

  liveBookmanning.com
  Secure APIsCross-site request forgery is an attack in which a victim's authenticated browser is induced to send an unintended request.

Compare how 5 books explain cross-site request forgery →

Related concepts

• CSRF tokenaddressed by · A CSRF token is an unpredictable server-issued value required on state-changing requests to verify that they originated from the intended application.
• state parameteraddressed by · A state parameter is an opaque client-generated value carried through an authorization exchange to bind the response to its initiating request and help prevent request forgery.
• csrf protectionaddresses · CSRF protection is a web security mechanism that prevents forged state-changing requests from an authenticated user's browser from being accepted.
• vulnerabilitykind of · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
• Spring Securityconfigured by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
• cross-site request forgery protectionaddressed by · Cross-site request forgery protection is a web-security technique that prevents unauthorized requests made on behalf of an authenticated user.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.