How to Prevent Cross-Site Request Forgery Attack?

Question

We ran Burp Suite on our product and found some security vulnerabilities. The tool detected some of the CGI files which are vulnerable to Cross-Site Request Forgery attacks (CSRF).

As usual I did search for CSRF protection module on CPAN and found CGI::Application::Plugin::ProtectCSRF.

I'm wondering how can I integrate this module into our application in a generalized way? The documentation is not clear to me. How do I configure this module and make minimal changes to make sure whole application is secured from CSRF.

I also came across mod_csrf (an Apache module to prevent CSRF). Is installing this module and setting below in apache configuration file enough to prevent CSRF?

<VirtualHost>

    CSRF_Enable on
    CSRF_Action deny
    CSRF_EnableReferer off

</VirtualHost>

Answer 1

Since we were using in house server, not apache, therefore, mod_csrf was not possible to implement.

I ditched ProtectCSRF module as the documentation was unclear.

I solved it by doing below:

1. Add an element in header template which is common to all pages, this element contains CSRF token which is being passed from server

2. Create a JavaScript function and bind it to onload event. This JS function does below tasks:

   a) Find forms in current page

   b) If forms are found then create a hidden "input" element and append it to each form

   c) Take the value which was put in header and assign it to above created elements

   d) Now all forms have a hidden input element which contains CSRF token from point 1

3. Now whenever a form gets submitted this hidden element will also be submitted, whose value we are verifying at server end. If tokens do not match then there is CSRF, for which we throw the error and block request