Logo image
Back
Client-Side Detection of Cross-Site Request Forgery Attacks
Conference proceeding   Peer reviewed

Client-Side Detection of Cross-Site Request Forgery Attacks

Hossain Shahriar and Mohammad Zulkernine
2010 IEEE 21st International Symposium on Software Reliability Engineering, pp.358-367
International Symposium on Software Reliability Engineering, 21st (San Jose, California, USA, 11/01/2010–11/04/2010)
11/2010
DOI: https://doi.org/10.1109/ISSRE.2010.12

Metrics

1 Record Views
Article has an altmetric score of 6

See more details

60 readers on Mendeley
1 readers on CiteULike

Abstract

Browser security client-side attack detection cross-site request forgery cross-site scripting Computer Science Cybersecurity Internet or World Wide Web (WWW)
Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack request takes advantage of the fact that a browser appends valid session information for each request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected request with a form's input fields and values that are being displayed on a webpage (visibility). To overcome an attacker's attempt to circumvent form visibility checking, we compare the response content type of a suspected request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack requests that include subsets of visible form fields and values.

Details

Logo image