XSRF Countermeasure
Welcome back to Devil's Blog On Security. Today we'll cover countermeasures against XSRF attacks. From our previous posts on XSRF attacks it is quite clear that XSRF vulnerabilities arise mostly due to automatic submission of cookies therefore one of the best things you can opt as an countermeasure is not to rely completely on HTTP cookies.
Avoid use of hidden variables in HTML pages for critical applications better use any other alternative.
A protected session management can even avoid XSRF attacks that can be executed using session hacking.
Don't ever rely on HTTP for HTTP Referrer header since it can be spoofed.
Keep all plug-ins of your web browser updated.
0 comments:
Post a Comment