CRSF攻击机制及防御策略研究

CSRF Attack Mechanism and Defense Strategy

跨站点请求伪造(Cross-Site Request Forgery)是一种互联网上广泛存在的网络攻击,它通过第三方伪造用户请求来欺骗服务器端,达到冒充用户身份、行使用户权利的目的。文中通过分析跨站点请求伪造攻击的原理,并模拟其攻击过程、解析攻击产生的原因来向读者详细介绍此类攻击的特点,并从服务器端和客户端两个方向讨论了防御此类攻击的策略。

Cross-site request forgery is a widespread network attack on the Internet. Through request forgery by the third party, this attack deceives the server, passes itself off as the user and exercises the rights of the users. This paper describes the characteristics of CSRF and analyzes the principle of CSRF. And meanwhile simulation on the attack process and exploration on the cause of this attack are also done, and the defense strategies against this attack discussed from both server and client sides.