django - What is a CSRF token ? What is its importance and how does it work? -


okay guys, writing django application , want idea of csrf token , how protects data. post data not safe if not use csrf tokens?

i know how use csrf_token need information how works.

cross-site request forgery (csrf) in simple words

  • assume logged online banking @ www.mybank.com
  • assume money transfer mybank.com result in request of (conceptually) form http://www.mybank.com/transfer?to=<someaccountnumber>;amount=<someamount>. (your account number not needed, because implied login.)
  • you visit www.cute-cat-pictures.org, not knowing malicious site.
  • if owner of site knows form of above request (easy!) , correctly guesses logged mybank.com (requires luck!), include on page request http://www.mybank.com/transfer?to=123456;amount=10000 (where 123456 number of cayman islands account , 10000 amount thought glad possess).
  • you retrieved www.cute-cat-pictures.org page, your browser make request.
  • your bank cannot recognize origin of request: web browser send request along www.mybank.com cookie , legitimate. there goes money!

this world without csrf tokens.

now better 1 with csrf tokens:

  • the transfer request extended third argument: http://www.mybank.com/transfer?to=123456;amount=10000;token=31415926535897932384626433832795028841971.
  • that token huge, impossible-to-guess random number mybank.com include on own web page when serve you. different each time serve page anybody.
  • the attacker not able guess token, not able convince web browser surrender (if browser works correctly...), , attacker not able create valid request, because requests wrong token (or no token) refused www.mybank.com.

result: keep 10000 monetary units. suggest donate of wikipedia.

(your mileage may vary.)


Comments

Post a Comment

Popular posts from this blog

javascript - Bootstrap Popover: iOS Safari strange behaviour -

i looking through twitter bootstrap documentation, , i'm interested in implementing dismissible popover when button clicked. here example bootstrap's docs: http://getbootstrap.com/javascript/#dismiss-on-next-click when press "dismissible popover" button os x safari browser works fine. when access same link above ios safari, button not work. is, popover not dismissed on click. why button not working ios safari? the example linked using data-trigger="focus" attribute. try changing data-trigger="click" . <a tabindex="0" class="btn btn-lg btn-danger" role="button" data-toggle="popover" data-trigger="click" title="dismissible popover" data-content="and here's amazing content. it's engaging. right?">dismissible popover</a>
Read more

Magento/PHP - Get phones on all members in a customer group -

i working on custom magento extension. working around adminhtml part , i've created custom form there. here form code: <?php class vivasindustries_smsnotification_block_adminhtml_sms_sendmass_edit_form extends mage_adminhtml_block_widget_form { public function _preparelayout() { $extensionpath = mage::getmoduledir('js', 'vivasindustries_smsnotification'); $head = $this->getlayout()->getblock('head'); $head->addjs('jquery.js'); $head->addjs('vivas.js'); return parent::_preparelayout(); } protected function _prepareform() { $form = new varien_data_form(array( 'id' => 'edit_form', 'action' => $this->geturl('*/*/save', array('id' => $this->getrequest()->get...
Read more

spring cloud - How to configure SpringCloud Eureka instance to point to https on non standard port -

i using spring boot/cloud actuator, , annotate application class @enableeurekaclient, applications comes , registers correctly eureka server. however, because configure application run on https, , on port 8444, eureka instance not registered correct protocol, instead using http. example http://localhost:8761/eureka/apps/ gives me <homepageurl>http://localhost:8444/</homepageurl> <statuspageurl>http://localhost:8444/info</statuspageurl> <healthcheckurl>http://localhost:8444/health</healthcheckurl> there no such thing securehomepageurl or securestatuspageurl - securehealthcheckurl exists. check com.netflix.appinfo.eurekainstanceconfig properties transmitted server when eureka client registers. however, having home/status/health page urls not showing https protocol doesn't mean instance isn't registered. matters whether or not secure port enabled. check following properties in client configuration: eureka.instance.se...
Read more