How can I prevent counterfeiting between measures?

Fanding on the crosspoint (XSRF or CSRF), also known as different names, including the wearer of requests for the cross -page, riding on the session and attack on one click, is a difficult type of use of a website to prevent. It works by cheating a web browser to send unauthorized commands to a remote server. Attacks on counterfeiting the cross -pipes work only against users who have logged in to the website with authentic login data; As a result, logging out of the website can be a simple and effective preventive measure. Website developers can use randomly generated tokens to help prevent this type of attack, but should avoid checking the referer or relying on cookies.

It is common for teaching for counterfeiting on the cross page of targeting on web browsers in what is called a "confused representative of the attack". Believer that acts behind the user's name is the browser deceived to send unauthorized commands to the remoteserver. These commands can be hidden inside the seemingly innocent parts of the branded code, which means that the eyewriter trying to download the image can actually send commands to the bank, online retailer or social networks. Some browsers now include measures designed to prevent counterfeiting between places, and third -party programmers have created extensions or plugins that lack these measures. It may also be good to turn off the e-mail with a language hypertext (HTML) in your preferred client, as these programs are also vulnerable to counterfeiting attacks.

Because counterfeiting attacks between the place rely on users who have legitimately logged in to the website. In view of this, it is one of the simplest ways to prevent such an attack, simply unsubscribe from the sites you have completed. Many sites that deal with sensitive data, includingBank and brokerage companies do it automatically after a certain period of inactivity. Other sites occupy the opposite approach and allow users to be persisted for several days or weeks. Although it may be appropriate, it exposes you to CSRF attacks. See "Do not forget me on this computer" or "Keep me logged in" and deactivate it and click the logout link when you complete the session.

For web developers, the elimination of erroneous counterfeits across measures can be a particularly demanding task. Control of information about the recommendation and cookie does not provide great protection, as the exploitation of CSRF takes advantage of the benefits of legitimate user data and this information easily spoof. A better approach would be a random token generation with one use every time the user logs in, and requires the token to be included in any user's request. For important requirements such as purchases or transfers of the fund may require the user to re -establishDrink username and password, ensure the authenticity of the request.