Skip to main content

Double Submit Cookie

Double submit cookie is one of the prevention method for Cross-Site Request Forgery (CSRF). Same as the synchronizer token pattern, it is using a cryptographic random value to validate a request agent. However, the implementation is different since the way it is saved is dissimilar. Here, the generated token value is saved in the browser, not on the server. Therefore servers no need to save huge amounts of data. When a user makes a request, the server compared the token value in the form DOM element (in the body) and token in the cookie header of the request. 
(Click on the images to view clearly)
Source code of the implemented program can be downloaded from here.
A login page, index.html has been implemented to enroll users.



Once the user entered the credentials, the form data will be submitted to login_handler.php using POST method.


If the username and password are correct, the user session is started and the username will be assigned to the session variable 'uname'. By default, the session identifier is saved as a cookie in the browser when session_start() is activated. Then the 32-byte length random binary is created and it is converted to a hex value. The random value (CSRF token) is assigned to the variable ‘token’. Further, the token is set as a cookie in the browser by passing the parameter like, token name, token value, and life span (1 day). Then the user will be redirected to home.html. The failed logins are redirected to index.php. 


In home.html, using getCookie function, particular CSRF token value will be extracted from the cookie and the derived value is assigned to the DOM element which has id as dom_csrf.



When the user submits the home.html form, the form data will be sent to form_submit.php.


The form_submit.php checks whether the token value in cookies is available or not. At the same time, token value in the form DOM element is compared with token value in the cookie. If both the values are same, the program displays a success message. If not CSRF token not matched message will be shown when the token is mismatched or the token not exist.

Comments

Post a Comment

Popular posts from this blog

Phishing - Hook for your data

Phishing is a trap to get your sensitive data through email which seems, it is from a trusted and well-known sender. This fraudulent attempt is done by online scammers (cybercriminal) to steal your identity and passwords to do crimes. The term “Phishing” was first used in 1996 that occurred in Usenet newsgroup called AOHell. Since the earlier hackers are called “Phreaks”, the ‘f’ in fishing replaced by ‘ph’. Even phishing attacks start to propagate through email, now it held by phone calls too. Mostly the attackers target a certain group or individual, Instead of sending emails to a large number of people. And those email seems like it is from reputed organization. Phishing emails make recipient panic by saying that your account has been hacked or there is an unrecognized activity occurred in your account and forced them to change their credentials using a given link. On the other hand, victims encourage to click on the link by saying that they have won a reward . When the receiv...
2 comments
Read more

Change Language in Google Account

When we create an email address, sometimes we do not consider the language preferences. Afterward, when we log in to a google account, context will be shown as unfamiliar. So we can change the language preferences of google account by following steps.  1.  Click on the Google profile and select google account 2.  Select data & personalization settings. 3. Scroll down and go to general preferences for the web. And click language. 4. If you need to change the default language, click on the pen sign. 5. If you want to add more languages, click on add other languages.
Post a Comment
Read more

Melissa - Nothing but a virus

Melissa refers to a virus, that Written in macro language (visual basic for application languages that use to create MS excel and other word processing software) and disseminates through e-mail attachment. It was the first malicious software which contains the virus, worm, and Trojan as one package and it was found in 1998-1999 span. Melissa has the capability to affect over 1 million computers within 3 days. Once your device is infected by Melissa, receiving emails will be blocked. The email which carries out the Melissa virus has subject line as “important message from someone” and body text starts with “here is that document you asked for… don’t show anyone else”. The email attachment typically stars as ‘LIST.Doc’. When the recipient opens the email or clicks on the attachment, the software will be immediately activated. Then it sends the same email to the emails addresses which are in the victim’s mail address book. And also it copies itself to documents that are in infected...
2 comments
Read more