Comments on: One-time Form tokens http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/ A tool for designers dealing with programmers dealing with designers... Tue, 30 Sep 2008 23:28:05 +0000 http://wordpress.org/?v=2.6.2 By: Gareth Heyes http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/#comment-545 Gareth Heyes Fri, 07 Sep 2007 09:10:55 +0000 http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/#comment-545 Hi Joseph If you only used cookies then it would be possible for an attacker to perform any action on your behalf by including an iframe on their site and forcing you to do an action. Form tokens are not the only method you can use, I've done a newer post which explains various techniques:- http://www.thespanner.co.uk/2007/08/21/protection-against-csrf-part-2/ If you randomise the URL on every login this can be a good way of protecting against CSRF but check out the examples above to see which is best for you. Hi Joseph

If you only used cookies then it would be possible for an attacker to perform any action on your behalf by including an iframe on their site and forcing you to do an action.

Form tokens are not the only method you can use, I’ve done a newer post which explains various techniques:-
http://www.thespanner.co.uk/2007/08/21/protection-against-csrf-part-2/

If you randomise the URL on every login this can be a good way of protecting against CSRF but check out the examples above to see which is best for you.

]]> By: Joseph Wilk http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/#comment-544 Joseph Wilk Fri, 07 Sep 2007 08:48:55 +0000 http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/#comment-544 Hello, It sounds like a good solution. It would be good for me but I have systems where its an issues to store server state. I try and operate with a REST model trying to ensure that there is little to no state at the server. Using cookies where possible for logins. Is it impossible to protect against this sort of attack without relying on server state? Thanks Hello,

It sounds like a good solution. It would be good for me but I have systems where its an issues to store server state. I try and operate with a REST model trying to ensure that there is little to no state at the server. Using cookies where possible for logins. Is it impossible to protect against this sort of attack without relying on server state?

Thanks

]]>