Search code examples
securitycsrfblacklist

Blacklist for CSRF attack

I wanna create a blacklist for CSRF attack. For example, in SQL injection, keywords like: select, from, where, drop and etc, can set in a blacklist. I was wondering that is it possible to create CSRF attack blacklist?

Solution

  • Not really... CSRF is a request to a real resource initiated by a browser with a real session. To somehow block it would mean blocking legit requests. The only ways are some CSRF token and checking of the origin/referer header in your web app