使用跨域JavaScript调用防止CSRF

Question

I'd like to protect my site against cross-site request forgery . I'm trying to follow these recommendations , by sending a session-specific token along with all requests that need to be protected.

The catch is that I have some requests that are designed to be called by third-party sites, on a different domain. Most of them use JSONP : they make a request to our server using a <script> tag, and the response is JavaScript code that calls a function on their page.

My question is, how to I pass the token in these requests? It seems like the third-party site would need to know the token. I could provide another request that returns the token as JSON, but then untrusted sites could make the same request, get the token, and use it to forge requests to our server.

Is there a better way to do this?

Answer 1

XSRF tokens are usually cookies on your domain that you generate. You really don't want to introduce a mechanism to allow other sites to set those. Verifying that a message comes from a trusted party is better treated as a signature verification problem.

You can have each partner site generate and keep a private/public signature key pair. Then they can send you their public key.

They can then sign their messages to you.

So their request would look like

 <script src="https://.../yourservice?partnerid=foobar&signedquerystring"></script>

and then you can signature check that the signed query string was properly signed using the public key you looked up by the key foobar .

You now know to trust the request if it either has your XSRF token or it is properly signed using the private key of a partner you've established a relationship with.

This won't stop someone who can observe a logged in user viewing the partner site from replaying the request, so the partner site and your script should both be loaded via a secure channel ( https ), just as you would with multiple-use XSRF tokens.

Answer 2

The solution to this problem that I am using is to embed an IFRAME inside the UI of an external widget I am creating. The only drawback here is the possibility of others using this iframe in a clickjacking attack. You could read about that here: https://security.stackexchange.com/questions/13341/security-issues-using-iframes .

Answer 3

I have the simplest solution to the JSONP CSRF problem, Add the "While(1);" or "for(,,);" or throw "F*** U"; in start of your json response data.

Now Any JSONP request end up in a infinite loop. Because you aren't using a JSONP request, you have the ability to modify the response by this code

JSON.parse(this.responseText.slice("while(1);".length));