What should I do to stop cross-site request forgeries in transfer.php and index.php (preventing Attack B)?
This issue was covered in the lecture on secure web site design, and in section. You need to rely on the Same Origin Principle to protect a piece of information that the attacker doesn’t know. The exact choice of what information to use is up to you, but it should not be easy to guess for an attacker who does not have access to the user’s account. Use that information to validate the posted form data. It should only take a couple lines of code in each file to fix.
Related Questions
- What can I do to assist students with disabilities who are eligible for notetaking services but reluctant to request and recruit a fellow classmate for copies of notes?
- When should an Institutional Review Board (IRB) or institution request a "407" review for research involving children as subjects?
- Is checking the "HTTP Referer" a valid method of stopping cross-site request forgeries?
