Cross Site Request Forgery (CSRF) Attacks
I found a site that has some good security tips for web developers. It mentions one type of attack that doesn't get much attention - called Cross Site Request Forgery (CSRF).
Basically lets say a user is logged into your site, and then they get an email, or go to a malicious web page (without logging out) that directs the user to a file on your site such as
/members/cancel_membership.cfm. Oops, they just ran that page as an authenticated user!
Attackers can use this technique to post comment spam, log out users (probably not so bad), change preferences, or do potentially anything your web application lets authenticated users do!
So to prevent these attacks you can't rely simply on checking the http referer because that can be spoofed. The article suggests that you:
- Require HTTP POST operations, instead of HTTP GET's (when your passing parameters)
- Include some sort of hash in the form post based on the users credentials, then validate the hash on the server before performing the operation.
- You will also want to do server side confirmations (eg: are you sure you want to delete?)
- csrfVerifyToken does not invalidate the token - February 6, 2019
- Firefox 3.5 Introduces Origin Header, Security Features - June 30, 2009
- Announcing Web Application Firewall for ColdFusion - July 9, 2007
- The Dangers of Flash's crossdomain.xml - November 2, 2006
- 20 ways to Secure your Apache Configuration - December 6, 2005
- Updating Java on ColdFusion or Lucee
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token
- The cf_sql_ is optional in cfqueryparam
- Cookie Expires / Max-Age 1969-12-31T23:59:59.000Z
- Burst Throttling on AWS API Gateway Explained