Systems and methods for cross site forgery protection

• US 8,640,216 B2
• Filed: 12/23/2009
• Issued: 01/28/2014
• Est. Priority Date: 12/23/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Anderson, Craig, Reddy, Anoop, Keinan, Yariv
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US12/645,924
• Publication Number:
  US 20110154473A1
• Time in Patent Office: 1,497 Days
• Field of Search: 726 11- 12, 726/30, 713151-152, 713/154
• US Class Current: 726/11
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The present solution described herein is directed towards systems and methods to prevent cross-site request forgeries based on web form verification using unique identifiers. The present solution tags each form from a server that is served out in the response with a unique and unpredictable identifier. When the form is posted, the present solution enforces that the identifier being returned is the same as the one that was served out to the user. This prevents malicious unauthorized third party users from submitting a form on a user'"'"'s behalf since they cannot guess the value of this unique identifier that was inserted.

Claims

1. A method of protecting against forgery of forms, the method comprising:

(a) identifying, by an application firewall executing on an intermediary device deployed between a plurality of clients and one or more servers, that a response to a first request of a client comprising;

application layer forms of a first form and a second form, the first form corresponds to a policy that identifies forms within network traffic traversing the intermediary device in which to include at least one form identifier;

(b) generating, by an identifier generator of the application firewall responsive to the identification, a form identifier for the first form that is unique and unpredictable among form identifiers transmitted via the intermediary device, the identifier generator using a random number from a random number generator as a seed for generating the form identifier;

(c) transmitting, by the application firewall to the client, the response comprising the form identifier embedded in the first form;

(d) receiving, by the application firewall, a second request from the client to send form data for the first form to the server;

(e) identifying, by the application firewall, that the second request from the client includes form data corresponding to the first form previously transmitted by the application firewall; and

(f) determining, by the application firewall responsive to identifying that the second request includes the form data, whether to send the second request to the server based on whether the second request identifies the form identifier transmitted with the response.

2. The method of claim 1, wherein step (b) further comprises generating at least one form identifier for each of the first form and the second form, each of the at least one form identifier unique and unpredictable among form identifiers embedded in the response transmitted by the intermediary device.

3. The method of claim 1, wherein step (c) further comprises embedding, by the application firewall, the form identifier into a hidden field in the first form.

4. The method of claim 1, wherein step (c) further comprises embedding, by the application firewall, the form identifier into an attribute value of the first form.

5. The method of claim 1, wherein step (d) further comprises receiving, by the application firewall, the second request comprising a POST request of the first form to the server.

6. The method of claim 1, wherein step (d) further comprises receiving, by the application firewall, the second request comprising a GET request with form data for the first form.

7. The method of claim 1, wherein step (f) further comprises determining, by the application firewall, that the second request does not have any form identifier and responsive to this determination, not sending the second request to the server.

8. The method of claim 1, wherein step (f) further comprises determining, by the application firewall, that the second request'"'"'s form identifier does not match the form identifier of the response and responsive to this determination, not sending the second request to the server.

9. The method of claim 1, wherein step (f) further comprises determining, by the application firewall, that the second request'"'"'s form identifier does match the form identifier of the response and responsive to this determination, sending the second request to the server.

10. The method of claim 1, further comprising receiving, by the application firewall, a third request from one of the client or a second client, the third request sending form data for a form for which the application firewall has not generated the form identifier and not sending the third request to the server.

11. A system for protecting against forgery of forms comprising:

an application firewall executing on an intermediary device deployed between a plurality of clients and one or more servers comprising;

a form verification engine of an application firewall executing on the intermediary device identifying that a response to a first request of a client comprising;

application layer forms of a first form and second form the first form corresponds to a policy that identifies forms within network traffic traversing the intermediary device in which to include at least one form identifier;

an identifier generator of the application firewall generating a form identifier for the first form that is unique and unpredictable among form identifiers transmitted via the intermediary device, the identifier generator using a random number from a random number generator as a seed for generating the form identifier;

wherein the form verification engine transmits to the client the response comprising the form identifier embedded in the first form, receives a second request from the client to send form data for the first form to the server, identifies that the second request from the client includes form data corresponding to the first form previously transmitted by the application firewall and determines whether to send the second request to the server based on whether the second request identifies the form identifier transmitted with the response responsive to identifying that the second request includes the form data.

12. The system of claim 11, wherein the identifier generator generates at least one form identifier for each of the first form and the second form, each of the at least one form identifier unique and unpredictable among form identifiers embedded in the response transmitted by the intermediary device.

13. The system of claim 11, wherein the form verification engine embeds the form identifier into a hidden field in the first form.

14. The system of claim 11, wherein the form verification engine embeds the form identifier into an attribute value of the first form.

15. The system of claim 11, wherein the form verification engine receives the second request comprising a POST request of the first form to the server.

16. The system of claim 11, wherein the form verification engine receives the second request comprising a GET request with form data for the first form.

17. The system of claim 11, wherein the form verification engine determines that the second request does not have any form identifier and responsive to this determination, does not send the second request to the server.

18. The system of claim 11, wherein the form verification engine determines that the second request'"'"'s form identifier does not match the form identifier of the response and responsive to this determination, does not send the second request to the server.

19. The system of claim 11, wherein the form verification engine determines that the second request'"'"'s form identifier matches the form identifier of the response and responsive to this determination, sends the second request to the server.

20. The system of claim 11, wherein the form verification engine receives a third request from one of the client or a second client, the third request sending form data for a form for which the identifier generator has not generated the form identifier and not sending the third request to the server.