验证FORM POST的来源以确保它来自同一服务器/应用程序

Question

I want find a platform/language agnostic solution to ensuring the origin of a FORM POST is from an expected source. Ie Page1.aspx posting to Page2.php within the same web site.

Specifically what I am attempting to do here is to prevent request forgery.

Answer 1

Use a hidden field in your form, which contains a token your app generated. Store the token in the user session. When the form is submitted, your app will check that the value of the hidden field is identical to the value stored in the user session.

If it is identical, then you know the submitted form comes from where it is expected to come.

Answer 2

Old Thread, but might still be useful.

If you do not have session info set (best option) then you can include a hidden field with an encrypted timestamp then compare it (after de-crypt) to the current time on the process end to make sure it is relatively close and thus as recent as you deem necessary.

Answer 3

You could include into the form a hidden field which would be the SHA1Hash("some-secret" + Remote_IP + PerSessionSecret).

The PerSessionSecret is something you autogenerate in the beginning of the session. "some-secret" is a global secret value - which will help a little bit in case the randomly generated PerSessionSecret turns out not to be very random enough.

Then do the same calculation upon the form submission and you know it's most probably submitted from the same client that it was sent to. (Of course, if you have multiple clients behind the single address, like a proxy or a NAT, you can not distinguish between them reliably).