クロスサイトリクエストフォージェリ対策 
一般にCSRFはセッションの利用に伴う脆弱性なのだから、予測不能な文字列を生成してhiddenとセッション内(PHPセッションの場合$_SESSION内)に入れておき、完了画面でこの2つを照会する方法が簡便で堅牢だと考えられる。(要はセッションを使ったワンタイムトークン方式)。
この対策だけでも充分だが、hiddenを横取りされた場合に発生する脆弱性に備え、Cookieでも比較を行う。
実際のコード
// 確認画面
session_start();
(認証など略)
$uniq_id = md5(uniqid(rand(),1)); // 推測不可能な文字列を生成
$_SESSION['uniq_id'] = $uniq_id; // セッションに保存
setcookie('uniq_id', $uniq_id); // Cookieにも保存
// hiddenにも入れておく
print "<input type=hidden name=uniq_id value='{$uniq_id}'/>";
// 完了画面
session_start();
(認証など略)
if($_POST['uniq_id'] == "")
exit('ワンタイムトークンが空'); // 全部空だと通ってしまうので。
if($_POST['uniq_id'] != $_SESSION['uniq_id'])
exit('ワンタイムトークン不一致'); // hiddenとセッション内とが合わない
if($_POST['uniq_id'] != $_COOKIE['uniq_id'])
exit('ワンタイムトークン不一致'); // hiddenとCookieとが合わない
// ここまで来ればCSRF攻撃ではない正規のアクセスだと考えられる
堅牢性
- セッション固定攻撃的手法
- 攻撃者はサーバのセッション内に偽のIDをセットすることができないので無効。
- hiddenの横取り
- hiddenは偽装できるが、攻撃対象者UAのCookie内にその値をセットしなければ攻撃が成立しない。
この対策が無効な場合
攻撃者が善意のユーザのUAを操作し、実際の確認画面を経て完了画面に遷移させるような場合はこの対策は無効となる(このような場合、現在行われているほとんど全てのCSRF対策は無効となる)。このようなことが可能であるならばそれはUAの深刻な脆弱性となる(CSRFどころの騒ぎではない)ので実際にこのようなことが起こるとは考えにくいが、あらゆる可能性を考慮するならば完了画面で再度認証を行うべきである。
2011/12/09 - 18:16:08 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/09 - 18:27:07 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/09 - 20:26:11 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/09 - 22:30:31 -
News info
I was reading the news and I saw this really interesting topic
2011/12/10 - 01:04:56 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/10 - 02:36:22 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/10 - 02:49:39 -
Dreary Day
It was a dreary day here today, so I just took to piddeling around on the internet and realized
2011/12/10 - 03:18:11 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/10 - 06:02:37 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/10 - 08:15:42 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/10 - 09:15:37 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/10 - 09:43:55 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/10 - 13:12:24 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/10 - 22:19:26 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/10 - 22:45:56 -
The best website……
[…]here are some links to sites that we link to because we think they are worth visiting[…]……
2011/12/10 - 23:36:36 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/11 - 00:50:50 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/11 - 01:43:52 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/11 - 03:29:28 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/11 - 03:46:33 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/11 - 05:20:44 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/11 - 06:08:05 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/11 - 08:10:16 -
Where To Look For Romance
[…]Awesome data that I’ve been seeking for some time! It really is great to know many people still care about this[…]
2011/12/11 - 14:49:23 -
abomas
You’re most welcome Thomas and I’ll certainly be keeping an eye out on future submitted posts of yours over at BlogEngage Karen recently posted..A Look At The United Kingdom Gaming Statistics [INFOGRAPHIC]
2011/12/11 - 18:15:32 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/11 - 21:25:42 -
Trackback for a Great Article…
[… ]Left you a trackback for your readers to get more info[… ]……
2011/12/11 - 22:27:14 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/11 - 22:34:55 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/11 - 22:37:44 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/11 - 22:48:23 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/11 - 23:54:24 -
Just Browsing
While I was browsing yesterday I noticed a excellent article about
2011/12/12 - 01:20:03 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/12 - 02:14:23 -
Recommended Resources
[…]the time to read or visit the content or sites we have linked to below the[…]
2011/12/12 - 03:16:10 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/12 - 03:27:13 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/12 - 07:27:23 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/12 - 10:50:51 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/12 - 13:13:51 -
best dating sites
Today, while I was at work, my cousin stole my iPad and tested to see if it can survive a 25 foot drop, just so she can be a youtube sensation. My apple ipad is now destroyed and she has 83 views. I know this is totally off topic but I had to share it …
2011/12/12 - 17:36:31 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/12 - 17:38:33 -
Trackback for a Great Article…
[… ]Left you a trackback for your readers to get more info[… ]……
2011/12/12 - 17:41:06 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/12 - 17:43:18 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/12 - 18:49:49 -
online dating services
Spot on with this write-up, I truly assume this web site wants way more consideration. I???ll most likely be once more to read rather more, thanks for that info.
2011/12/12 - 19:08:09 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/12 - 20:33:50 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/12 - 22:12:39 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 00:36:03 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/13 - 01:03:20 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/13 - 03:10:53 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/13 - 03:29:20 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/13 - 03:33:50 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/13 - 05:31:26 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/13 - 06:37:31 -
Visitor recommendations trackback
[…]great article that everyone should read[…]
2011/12/13 - 07:35:05 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/13 - 08:28:33 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 09:12:43 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/13 - 09:58:42 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/13 - 12:12:12 -
Interesting….
A very neat post.
2011/12/13 - 13:10:20 -
Dreary Day
It was a dreary day here today, so I just took to messing around online and realized
2011/12/13 - 18:28:30 -
Interesting….
A very interesting post.
2011/12/13 - 20:24:19 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/13 - 22:45:32 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/13 - 22:48:50 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/14 - 02:29:13 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/14 - 04:01:21 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/14 - 04:29:41 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/14 - 05:39:30 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/14 - 09:26:53 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/14 - 16:40:46 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/14 - 19:09:09 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/14 - 19:40:33 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/14 - 20:28:31 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/14 - 22:01:50 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 23:21:20 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/15 - 01:11:57 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 06:18:42 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/15 - 06:21:30 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/15 - 07:10:24 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/15 - 07:38:21 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 08:31:00 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/15 - 11:34:54 -
Solglasögon Online Here
[…]It’s wonderful that people nevertheless know a whole lot about point like that. In no way forget you will discover other options[…]
2011/12/15 - 16:05:09 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/15 - 20:40:18 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/15 - 22:27:57 -
free dating services
Yet another issue is really that video gaming became one of the all-time largest forms of fun for people of every age group. Kids have fun with video games, plus adults do, too. The particular XBox 360 is amongst the favorite games systems for many who…
2011/12/15 - 22:39:58 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/15 - 23:07:45 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/16 - 00:33:25 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/16 - 00:46:46 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/16 - 01:45:26 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/16 - 02:00:05 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/16 - 05:14:24 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/16 - 08:23:04 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/16 - 08:41:01 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/16 - 08:56:44 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/16 - 09:45:53 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/16 - 09:48:13 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…