Robust defenses for cross-site request forgery

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 75-87

  Barth, Adam ^a   Jackson, Collin ^a   Mitchell, John C ^a  

^a STANFORD UNIVERSITY   (United States)

Author keywords

Cross site request forgery; HTTP referer header; Same origin policy; Web application firewall

Indexed keywords

CROSS SITE SCRIPTING; CROSS-SITE REQUEST FORGERY; DEFENSE TECHNIQUES; EXPERIMENTAL OBSERVATION; LONG TERM; PRIVACY CONCERNS; SAME-ORIGIN POLICY; WEB APPLICATION FIREWALL;

COLD HEADING; COMPUTER SYSTEM FIREWALLS; NETWORK LAYERS; WORLD WIDE WEB;

HTTP;

EID: 70349266257     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1455770.1455782     Document Type: Conference Paper

References (51)

1. David Airey. Google's Gmail security failure leaves my business sabotaged, December 2007. http://www. davidairey.co. uk/google-gmail-security- hij ack/.
2. Robert Auger. The cross-site request forgery (CSRF/XSRF) FAQ, 2007. http: //www.cgisecurity.com/articles/csrf-faq.shtml.
3. Michael Barbaro and Tom Zeller Jr. A face is exposed for AOL searcher no. 4417749. The New York Times, August 2006. http://www.aytimes.com/2006/ 08/09/ technology/09aol.htm.
4. Adam Barth, Collin Jackson, and John C. Mitchell. Securing frame communication in browsers. In In Proceedings of the 17th USENIX Security Symposium(USENIX Security 2008), July 2008.
5. Tim Berners-Lee, Roy Fielding, and Henrik Frystyk. Hypertext Transfer Protocol-HTTP/1.0. RFC 1945, May 1996.
6. Douglas Crockford. JSONRequest, 2006. http://json.org/JSONRequest.html.
7. Neil Daswani, Christoph Kern, and Anita Kesavan. Foundations of Security: What Every Programmer Needs to Know. Apress, 2007.
8. Rogan Dawes. Session Fixation, 2008. http://www.owasp.org/index.php/ Session-Fixation-Protection.
9. Rohit Dhamankar et al. Sans top-20 security risks, 2007. http://www.sans.org/top20/2007/.
10. Rachna Dhamija, J. D. Tygar, and Marti Hearst. Why phishing works. In Proceedings of the Conference on Human Factors in Computing Systems (CHI), 2006.
11. E. W. Felten, D. Balfanz, D. Dean, and D. S. Wallach. Web Spoofing: An Internet Con Game. In 20th National Information Systems Security Conference, October 1997.
12. Brad Fitzpatrick, David Recordon, Dick Hardt, Johnny Bufu, Josh Hoyt, et al. OpenlD authentication 2.0, December 2007. http://openid.net/specs/openid- authentication-2-0.html.
13. Seth Fogie, Jeremiah Grossman, Robert Hansen, Anton Rager, and Petko D. Petkov. XSS Attacks: Cross Site Scripting Exploits and Defense. Syngress, 2007.
14. Mozilla Foundation. Security advisory 2005-58, September 2005. http://www.mozilla.org/security/ announce/2005/mfsa2005-58.html.
15. Google. Security for GW'T Applications, http: //groups.google.com/group/ Google-Web-Toolkit/ web/security-for-gwt-applications.
16. Robert Hansen and Tom Stracener. Xploiting Google gadgets: Gmalware and beyond, August 2008. Black Hat briefing.
17. Elliotte Rusty Harold. Privacy tip #3: Block Referer headers in Firefox, October 2006. http://cafe.elharo.com/privacy/privacy-tip-3 -block-referer- headers-in-firefox/.
18. Mario Heiderich. CSRFx, 2007. http://php-ids.org/category/csrfx/.
19. Ian Hickson et al. Cross-document messaging. http://www.w3.org/html/wg/ html5/ #crossDocumentMessages.
20. Ian Hickson et al. HTML 5 Working Draft, http: //www.whatwg.org/specs/ web-apps/current-work/.
21. Dan Holevoet. Changes to inline gadgets, August 2008. http://igoogledeveloper.blogspot.com/ 2008/08/changes-to-inlined-gadgets.html.
22. Collin Jackson. Defeating frame busting techniques, 2005. http: //crypto. Stanford, edu/f ramebust/.
23. Collin Jackson and Adam Barth. ForceHTTPS: Protecting high-security web sites from network attacks. In Proceedings of the 17th International World Wide Web Conference (WWW), April 2008.
24. Collin Jackson, Adam Barth, Andrew Bortz, Weidong Shao, and Dan Boneh. Protecting browsers from DNS rebinding attacks. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS 2007), November 2007.
25. Collin Jackson, Andrew Bortz, Dan Boneh, and John C. Mitchell. Protecting browser state from web privacy attacks. In Proceedings of the 15th International World Wide Web Conference (WWW), May 2006.
26. Martin Johns and Justus Winter. RequestRodeo: Client side protection against session riding. In Proceedings of the OWASP Europe 2006 Conference, May 2006.
27. Aaron Johnson. The Referer header, intranets and privacy, February 2007. http://cephas.net/blog/2007/02/06/ the-referer-header-intranets-and-privacy/.
28. Paul Johnston and Richard Moore. Multiple browser cookie injection vulnerabilities, September 2004. http://www.westpoint.ltd.uk/advisories/ wp-04-0001.txt.
29. Nenad Jovanovic, Engin Kirda, and Christopher Kruegel. Preventing cross site request forgery attacks. In IEEE International Conference on Security and Privacy in Communication Networks (SecureComm), 2006.
30. Chris Karlof, Umesh Shankar, J. D. Tygar, and David Wagner. Dynamic pharming attacks and locked same-origin policies for web browsers. In Proceedings of the Ufth ACM Conference on Computer and Communications Security (CCS 2007), November 2007.
31. Amit Klein. Exploiting the XMLHttpRequest object in IE-Referrer spoofing and a lot more..., September 2005. http: //www.cgisecurity.com/lib/ XmlHTTPRequest.shtml.
32. Peter-Paul Koch. Frame busting. http://www.quirksmode.org/j s/framebust.html.
33. David Kristol and Lou Montulli. HTTP State Management Mechanism. RFC 2965, October 2000.
34. David Kristol and Lou Montulli. HTTP State Management Mechanism. RFC 2109, February 1997.
35. V. T. Lam, Spiros Antonatos, P. Akritidis, and Kostas G. Anagnostakis. Puppetnets: Misusing web browsers as a distributed attack infrastructure. In Proceedings of the 13th ACM Conference on Computer and Communication Security (CCS), October 2006.
36. PHP Manual. Session handling functions, http: //www.phpbuilder.com/ manual/en/ref.session.php.
37. Chris Masone, Kwang-Hyun Baek, and Sean Smith. WSKE: Web server key enabled cookies. In Proceedings of Usable Security 2007 (USEC '07).
38. Microsoft. XDomainRequest object. http://msdn2.microsoft.com/en-us/ library/ cc288060(VS.85).aspx.
39. Netscape. Persistent client state: HTTP cookies. http: //wp.netscape.com/newsref/std/cookie-spec.html.
40. Greg Pass, Abdur Chowdhury, and Cay ley Torgeson. A picture of search. In InfoScale '06: Proceedings of the 1st International Conference on Scalable Information Systems, 2006.
41. Petko D. Petkov. Google Gmail e-mail hijack technique, September 2007. http://www.gnucitizen.org/blog/ google-gmail-e-mail-hijack-technique/.
42. Yngve Pettersen. HTTP state management mechanism v2. IETF Internet Draft. February 2008. http://www.ietf.org/internet-drafts/ draft-pettersen-cookie-v2- 02.txt,
43. phpBB. http://phpbb.com/.
44. Prototype JavaScript framework. http://www.prototypejs.org/.
45. Ruby on rails, http://www.rubyonrails.org/.
46. Secunia. Microsoft Internet Explorer "XMLHTTP" HTTP request injection, September 2005. http://secunia.com/advisories/16942/.
47. Eric Sheridan. OWASP CSRFGuard Project, 2008. http://www.owasp.org/index. php/CSRF-Guard.
48. Trac. http://trac.edgewall.org/.
49. Anne van Kesteren et al. Access control for cross-site requests, http: //www. w3. org/TR/access-control/.
50. Luis von Ahn, Nick Hopper Manuel Blum, and John Langford. CAPTCHA: Using hard AI problems for security. In Eurocrypt 2003.
51. Weilin Zliong. Session Fixation, 2008. http: //www.owasp.org/index.php/ Session-Fixation.