Search code examples
csrfcsrf-protection

Doubt on prevention of CSRF

I had one doubt about CSRF prevention. A lot of sites say that CSRF can be prevented by using 'tokens' which are randomly generated per session.

Now my doubt is, suppose i have a function like : 

$.post("abcd.php",{'fbuid':userid,'code':'<?php echo  md5($_SESSION['randcode']); ?>'}

now this md5 hash would obviously be visible to any hacker through the source code.He could simply open this page, generate a token, and keep the page open, so that the session doesn't get destroyed, and useanother tab or anything else , to start hacking,

No ?

Or is my idea of tokens incorrect ?

Thanks for your help :D

Solution

  • I think you are misunderstanding what needs to be done. To protect against CSRF you need to create a token and save it for that session. Then you need to append all your submits and AJAX calls with that token.

    For another person to send you to a page on your website they would need to have access to the request with in the same session. It is true that one could parse the HTML and look for the token. But when they try to request a http call on your website they will have a new session created. The new session will have a new token which will not match the token that was passed.

    Next you will ask what if you can copy the cookies and the session id as a result. This is not something that is protected. I can simply sit anybody's computer and copy all their cookies and I will then be logged in as them.