Systems and methods for cross site forgery protection
First Claim
Patent Images
1. A method of protecting against forgery of forms, the method comprising:
- (a) identifying, by an application firewall executing on an intermediary device deployed between a plurality of clients and one or more servers, that a response to a first request of a client comprising;
application layer forms of a first form and a second form, the first form corresponds to a policy that identifies forms within network traffic traversing the intermediary device in which to include at least one form identifier;
(b) generating, by an identifier generator of the application firewall responsive to the identification, a form identifier for the first form that is unique and unpredictable among form identifiers transmitted via the intermediary device, the identifier generator using a random number from a random number generator as a seed for generating the form identifier;
(c) transmitting, by the application firewall to the client, the response comprising the form identifier embedded in the first form;
(d) receiving, by the application firewall, a second request from the client to send form data for the first form to the server;
(e) identifying, by the application firewall, that the second request from the client includes form data corresponding to the first form previously transmitted by the application firewall; and
(f) determining, by the application firewall responsive to identifying that the second request includes the form data, whether to send the second request to the server based on whether the second request identifies the form identifier transmitted with the response.
8 Assignments
0 Petitions
Accused Products
Abstract
The present solution described herein is directed towards systems and methods to prevent cross-site request forgeries based on web form verification using unique identifiers. The present solution tags each form from a server that is served out in the response with a unique and unpredictable identifier. When the form is posted, the present solution enforces that the identifier being returned is the same as the one that was served out to the user. This prevents malicious unauthorized third party users from submitting a form on a user'"'"'s behalf since they cannot guess the value of this unique identifier that was inserted.
-
Citations
20 Claims
-
1. A method of protecting against forgery of forms, the method comprising:
-
(a) identifying, by an application firewall executing on an intermediary device deployed between a plurality of clients and one or more servers, that a response to a first request of a client comprising;
application layer forms of a first form and a second form, the first form corresponds to a policy that identifies forms within network traffic traversing the intermediary device in which to include at least one form identifier;(b) generating, by an identifier generator of the application firewall responsive to the identification, a form identifier for the first form that is unique and unpredictable among form identifiers transmitted via the intermediary device, the identifier generator using a random number from a random number generator as a seed for generating the form identifier; (c) transmitting, by the application firewall to the client, the response comprising the form identifier embedded in the first form; (d) receiving, by the application firewall, a second request from the client to send form data for the first form to the server; (e) identifying, by the application firewall, that the second request from the client includes form data corresponding to the first form previously transmitted by the application firewall; and (f) determining, by the application firewall responsive to identifying that the second request includes the form data, whether to send the second request to the server based on whether the second request identifies the form identifier transmitted with the response. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A system for protecting against forgery of forms comprising:
an application firewall executing on an intermediary device deployed between a plurality of clients and one or more servers comprising; a form verification engine of an application firewall executing on the intermediary device identifying that a response to a first request of a client comprising;
application layer forms of a first form and second form the first form corresponds to a policy that identifies forms within network traffic traversing the intermediary device in which to include at least one form identifier;an identifier generator of the application firewall generating a form identifier for the first form that is unique and unpredictable among form identifiers transmitted via the intermediary device, the identifier generator using a random number from a random number generator as a seed for generating the form identifier; wherein the form verification engine transmits to the client the response comprising the form identifier embedded in the first form, receives a second request from the client to send form data for the first form to the server, identifies that the second request from the client includes form data corresponding to the first form previously transmitted by the application firewall and determines whether to send the second request to the server based on whether the second request identifies the form identifier transmitted with the response responsive to identifying that the second request includes the form data. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
Specification