Search code examples
securitycsrf

Does anyone see any downsides of doing the following to prevent CSRF?

I'm wondering if the following method will completely prevent CSRF, and be compatible with all users.

Here it is:

In the form just include an extra parameter that is: encrypted(user's userID + request time). Server-side just decrypt and make sure it's the right userID and the request time was reasonably recent.

Aside from someone sniffing the user's traffic or breaking the encryption, is this completely secure? Are there any downsides?

Solution

  • While your approach is safe it is not standard. The standard way to prevent CSRF attacks is to generate pseudo-random number that you include in a hidden field and also in a cookie and then on the server side you verify that both values match. Take a look at this post.