Cross-Site Request Forgery Prevention
- The key take-away — don’t let a monster near your cookies; they will tempt the server with them!
- Same Origin Policy is enforced client-side. Exceptions can be made if a server response with headers
Access-Control-Allow-Origin: *comes back that allows cross-origin requests to a resource. - Prevent against forged request with a securely generated random Anti-CSRF token
- A session bound value that changes with each login session
- A server-side value stored in an environment variable used to generate HMAC hash
Cross-Site Request Forgery Prevention
Interactive graph