Cross-site request forgery protection

• US 8,839,424 B2
• Filed: 11/15/2012
• Issued: 09/16/2014
• Est. Priority Date: 11/15/2012
• Status: Expired due to Fees

• Current Assignee: Digital Theorem
• Original Assignee: Robert Hansen
• Inventors: Hansen, Robert
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US13/678,274
• Publication Number:
  US 20140137189A1
• Time in Patent Office: 670 Days
• Field of Search: 726/25, 726/13, 726/22, 726/23
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A cross-site request forgeries (CSRF) protection system helps protect against cross-site request forgeries attacks. A CSRF protector is arranged to receive a signal from a service provider that notifies a browser running on a potential victim consumer machine to selectively permit and/or deny cross-site requests in accordance with a set of one or more security policies. The policies can be selected and applied on a domain name basis, IP address basis, trusted zone basis, and combinations thereof. The CSRF protector can also provide a context of the event that triggers a request that contains a cross-site request, where the context provides indicia of circumstances that indicate a likelihood of a cross-site request forgery is being attempted.

Claims

1. A method, comprising:

receiving, from a server, a cross-site request forgery (CSRF) warning signal that is associated with a service provider and is arranged to notify consumers the service provider provides services that are to be protected against cross-site request forgery-related exploits, wherein the CSRF warning signal includes an indication of an address to which a request, which is arranged to be executed by the service provider, is to be sent by the consumer side;

determining, in a consumer side, whether the request, which is generated during a secure session between a consumer of the consumer side and the server, is arranged to be executed by a service provider and comprises a cross-site request that is cross-sited with respect to a server website with which the secure session is established; and

taking a protective action, in the consumer side, in response to the determined cross-site request and in response to the cross-site request forgery warning signal received from the service provider, wherein the protective action includes blocking a portion of the cross-site request from being transmitted from the consumer to the server.

2. The method of claim 1, wherein a network-enabled application executing on the consumer side includes a document object model (DOM) that generates the request that is arranged to be executed by the service provider, and the protective action is taken by a process executing on the consumer.

3. The method of claim 2, wherein the server is the service provider, and wherein the server website is hosted by the server.

4. The method of claim 3, wherein the service provider is arranged to send the CSRF warning signal to the consumer side in response to a secure session being established between the service provider and the consumer side.

5. The method of claim 1, wherein the protective action includes blocking the cross-site request from being sent to the service provider.

6. The method of claim 5, wherein the cross-site request is selectively blocked from being sent to the service provider in response to a policy selected in response to the CSRF warning signal.

7. The method of claim 6, wherein the selected policy is selected from a list of policies stored on the consumer side.

8. The method of claim 5, wherein the protective action is taken in response to an input of the consumer side received from a user that is notified of the determined cross-site request.

9. The method of claim 5, comprising determining whether the cross-site request references a network resource that lies outside of a trusted zone that includes the consumer side.

10. The method claim 1, wherein the protective action includes sending a cross-site request trigger context of the generation of the cross-site request.

11. The method of claim 10, wherein the cross-site request trigger context is sent in response to the CSRF warning signal.

12. The method of claim 11, wherein the cross-site request trigger context provides an indication of the type of object from which the request that is arranged to be executed by the service provider was triggered.

13. The method of claim 12, comprising taking the protective action in the service provider in response to a cross-site address of the determined cross-site request and in response to the indication of the type of object from which the request that is arranged to be executed by the service provider was triggered.

14. The method of claim 10, comprising sending indicia of cross-site request forgery attacks to clients of the service provider.

15. The method of claim 12, wherein the cross-site request trigger context is sent to an address selected in response to an address indicated by the CSRF warning signal.

16. A non-transitory, tangible medium including instructions that, when executed on a processor of an electronic system, comprise:

receiving, from a server, a cross-site request forgery (CSRF) warning signal that is associated with a service provider and is arranged to notify consumers the service provider provides services that are to be protected against cross-site-related exploits, wherein the CSRF warning signal includes an indication of an address to which a consumer request, which is arranged to be executed by the service provider, is to be sent by the consumer side;

determining, in a consumer side, whether the consumer request, that is generated during a secure session between a consumer of the consumer side and the server, is arranged to be executed by a service provider and includes a cross-site request that is cross-sited with respect to a server website with which the secure session is established; and

taking a protective action in response to the determined cross-site request and in response to a cross-site warning signal received from the service provider, wherein the protective action includes blocking a portion of the cross-site request from being transmitted from the consumer to the server.

17. The medium of claim 16, wherein the server is the service provider.

18. The medium of claim 17, comprising sending a cross-site request trigger context to the service provider in response to the CSRF warning signal.

19. The medium of claim 18, comprising comparing the cross-site request trigger context with predetermined indicia of cross-site request forgery attacks.

20. The medium of claim 19, wherein the cross-site request trigger context includes information concerning an object in the consumer side that triggers a generation of the cross-site request.

21. A web browsing system, comprising:

a memory including data of a signal evaluator that is arranged to determine whether a cross-site request forgery (CSRF) warning signal has been received, wherein the CSRF warning signal is associated with a service provider and is arranged to notify consumers the service provider provides services that are to be protected against cross-site-related exploits, and wherein the CSRF warning signal includes an indication of an address to which a request, which is arranged to be executed by the service provider, is to be sent by the consumer side; and

a processor arranged to execute instructions of a CSRF protector that is arranged to generate, during a secure session between a consumer of the consumer side and the service provider, the request that is to be executed by the service provider, and arranged to determine whether the request is a cross-site request that is cross-sited with respect to a server website with which the secure session is established, and wherein the processor is arranged to take a protective action that includes blocking a portion of the cross-site request from being transmitted from the consumer to the service provider.

22. The system of claim 21, wherein the CSRF protector is arranged to determine whether the request that is to be executed comprises a cross-site request that includes a payload for exploiting the trust the service provider has with a network-enabled application that is used to establish the secure session.

23. The system of claim 22, wherein the signal evaluator is arranged to determine whether a URL provided by the service provider contains an indication of the CSRF warning signal.

24. The system of claim 22, wherein the CSRF warning signal is a non-encrypted signal received via the service provider, a domain name system (DNS) server, or both.

25. The system of claim 24, wherein the protective action includes blocking the cross-site request from being sent to the service provider.

26. The system of claim 25, wherein the cross-site request is selectively blocked from being sent to the service provider in response to a policy selected from a policy library in response to the CSRF warning signal.

27. The system of claim 26, wherein the selected policy is selected in response to determining whether the cross-site request is arranged to address a third party device that lies outside of a trusted network having addresses stored in a trusted network database.

28. The system of claim 24, wherein the protective action includes sending cross-site request trigger context of the generation of the cross-site request.

29. The system of claim 28, wherein the cross-site request trigger context is sent in response to receiving the CSRF warning signal.

30. The system of claim 29, wherein the cross-site request trigger context provides an indication of the type of object from which the request was triggered.