CSRF-发送Ajax请求以获取令牌

Question

I am developing CSRF protection for my website.

I am saving token in hidden input in form + session, then i check if they're equal.

I am just wondering about this scenario :

• user visits malicious website
• malicious website sends ajax GET request to get page with form and extracts token from it
• malicious website sends POST request to change data + token extracted earlier.

Would that be possible in this scenario? Am i missing something?

Answer 1

Each website must have an unique token to make it work and it is assigned server-side. Take a look a little example on how we made it: https://blog.myetv.tv/2017/09/18/writing-secure-code-how-myetv-do-crypt-auth-transfer-and-store-informations/

You could have sessionID or/and another type of data in the token, for example the userip (if you want you can also encrypt them with AES to make it more unique and basically impossible to be cloned); the encryption method is just additional and could be very intensive in terms of speed, you should value for how you use it (in the most cases the unique sessionid hashed with SHA is ok).

Hope it helps ;)