Try the SEARCH function in the main navigation to find something. If you are looking for chapter information, please see Chapters for the correct chapter. For information about OWASP projects see Projects. For common attacks, vulnerabilities, or information about other community-led contributions see Contributed Content.
12 | 13 |If all else fails you can search our historical site.
15 |Get or increment the counter:
41 |If the counter can be externally incremented, it signals that there is a vulnerability in the solution.
42 | 43 | 44 | 48 |Mimic hosting the exploits on a different domain:
25 |Tokens should not be injected into links referencing different domains if the domainStrict property is set to true.
47 | 51 |11 | The current approach of the OWASP CSRFGuard relies on JavaScript logic for injecting CSRF tokens into HTML elements or XHR requests. 12 | Forcing synchronous loading of the AJAX requests has been disabled, since they were 13 | deprecated 14 | due to their negative impact on the user experience. For this reason, protecting resources that would load 15 | before or in parallel with the JavaScript logic (e.g. references IFrames or IMG tags) is not possible. 16 | In most cases this should not be a problem, because usually GET requests should not facilitate state-changing operations. 17 | If this last condition cannot be fulfilled (e.g. for legacy applications), backwards compatibility can be achieved by enabling the 18 | "forceSynchronousAjax" property within the configurations, until there is browser support for it. 19 |
20 |Aims to test token injection for referenced protected pages that are loaded before user interaction.
22 |
23 |
24 |
25 |
Aims to test token injection for referenced protected pages that are loaded before user interaction.
27 | 
28 |
29 |
30 |
--------------------------------------------------------------------------------
/csrfguard-test/csrfguard-test-jsp/src/main/webapp/owasp_logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/OWASP/www-project-csrfguard/cb951a1ae5c162e0f62d046348906e995b793775/csrfguard-test/csrfguard-test-jsp/src/main/webapp/owasp_logo.png
--------------------------------------------------------------------------------
/csrfguard-test/csrfguard-test-jsp/src/main/webapp/protect.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
true if the client does not yet know about the
46 | * session or if the client chooses not to join the session.
47 | *
48 | * @see javax.servlet.http.HttpSession#isNew()
49 | *
50 | * @return true if the server has created a session, but the client has not yet joined
51 | */
52 | boolean isNew();
53 |
54 | /**
55 | * Invalidates this session then unbinds any objects bound to it.
56 | */
57 | void invalidate();
58 |
59 | /**
60 | * @return whether the objects were generated or not.
61 | */
62 | boolean areTokensGenerated();
63 |
64 | /**
65 | * Set whether the objects were generated or not.
66 | *
67 | * @param areTokensGenerated set true if the tokens were generated, false otherwise
68 | */
69 | void setTokensGenerated(boolean areTokensGenerated);
70 |
71 | /**
72 | * Saves an object to the current session
73 | *
74 | * @see HttpSession#setAttribute(java.lang.String, java.lang.Object)
75 | *
76 | * @param attribute the name to which the object is bound; cannot be null
77 | * @param value the object to be bound
78 | */
79 | void setAttribute(final String attribute, final Object value);
80 |
81 | /**
82 | * Retrieves an object from the session using its name
83 | *
84 | * @see HttpSession#getAttribute(String)
85 | *
86 | * @param attributeName - identifies a certain object on the session
87 | * @return the object associated to the attribute name
88 | */
89 | Object getAttribute(String attributeName);
90 | }
91 |
--------------------------------------------------------------------------------
/csrfguard/src/main/java/org/owasp/csrfguard/token/TokenUtils.java:
--------------------------------------------------------------------------------
1 | /*
2 | * The OWASP CSRFGuard Project, BSD License
3 | * Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
4 | * All rights reserved.
5 | *
6 | * Redistribution and use in source and binary forms, with or without
7 | * modification, are permitted provided that the following conditions are met:
8 | *
9 | * 1. Redistributions of source code must retain the above copyright notice,
10 | * this list of conditions and the following disclaimer.
11 | * 2. Redistributions in binary form must reproduce the above copyright
12 | * notice, this list of conditions and the following disclaimer in the
13 | * documentation and/or other materials provided with the distribution.
14 | * 3. Neither the name of OWASP nor the names of its contributors may be used
15 | * to endorse or promote products derived from this software without specific
16 | * prior written permission.
17 | *
18 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | */
29 |
30 | package org.owasp.csrfguard.token;
31 |
32 | import org.owasp.csrfguard.CsrfGuard;
33 | import org.owasp.csrfguard.exception.CSRFGuardTokenException;
34 | import org.owasp.csrfguard.util.MessageConstants;
35 | import org.owasp.csrfguard.util.RandomGenerator;
36 |
37 | public final class TokenUtils {
38 |
39 | private TokenUtils() {}
40 |
41 | /**
42 | * Create a random token based on the configuration.
43 | *
44 | * @return a random token
45 | */
46 | public static String generateRandomToken() {
47 | try {
48 | final CsrfGuard csrfGuard = CsrfGuard.getInstance();
49 | return RandomGenerator.generateRandomId(csrfGuard.getPrng(), csrfGuard.getTokenLength());
50 | } catch (final Exception e) {
51 | final String errorLiteral = MessageConstants.RANDOM_TOKEN_FAILURE_MSG + " - " + "%s";
52 | throw new CSRFGuardTokenException(String.format(errorLiteral, e.getLocalizedMessage()), e);
53 | }
54 | }
55 | }
56 |
--------------------------------------------------------------------------------
/csrfguard/src/main/java/org/owasp/csrfguard/token/mapper/TokenMapper.java:
--------------------------------------------------------------------------------
1 | /*
2 | * The OWASP CSRFGuard Project, BSD License
3 | * Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
4 | * All rights reserved.
5 | *
6 | * Redistribution and use in source and binary forms, with or without
7 | * modification, are permitted provided that the following conditions are met:
8 | *
9 | * 1. Redistributions of source code must retain the above copyright notice,
10 | * this list of conditions and the following disclaimer.
11 | * 2. Redistributions in binary form must reproduce the above copyright
12 | * notice, this list of conditions and the following disclaimer in the
13 | * documentation and/or other materials provided with the distribution.
14 | * 3. Neither the name of OWASP nor the names of its contributors may be used
15 | * to endorse or promote products derived from this software without specific
16 | * prior written permission.
17 | *
18 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | */
29 | package org.owasp.csrfguard.token.mapper;
30 |
31 | import org.owasp.csrfguard.token.businessobject.TokenBO;
32 | import org.owasp.csrfguard.token.transferobject.TokenTO;
33 |
34 | public final class TokenMapper {
35 |
36 | private TokenMapper() {}
37 |
38 | public static TokenTO toTransferObject(final TokenBO tokenBO) {
39 | return new TokenTO(tokenBO.getUpdatedMasterToken(), tokenBO.getUpdatedPageTokens());
40 | }
41 | }
42 |
--------------------------------------------------------------------------------
/csrfguard/src/main/java/org/owasp/csrfguard/token/storage/LogicalSessionExtractor.java:
--------------------------------------------------------------------------------
1 | /*
2 | * The OWASP CSRFGuard Project, BSD License
3 | * Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
4 | * All rights reserved.
5 | *
6 | * Redistribution and use in source and binary forms, with or without
7 | * modification, are permitted provided that the following conditions are met:
8 | *
9 | * 1. Redistributions of source code must retain the above copyright notice,
10 | * this list of conditions and the following disclaimer.
11 | * 2. Redistributions in binary form must reproduce the above copyright
12 | * notice, this list of conditions and the following disclaimer in the
13 | * documentation and/or other materials provided with the distribution.
14 | * 3. Neither the name of OWASP nor the names of its contributors may be used
15 | * to endorse or promote products derived from this software without specific
16 | * prior written permission.
17 | *
18 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | */
29 | package org.owasp.csrfguard.token.storage;
30 |
31 | import org.owasp.csrfguard.session.LogicalSession;
32 |
33 | import javax.servlet.http.HttpServletRequest;
34 |
35 | public interface LogicalSessionExtractor {
36 |
37 | /**
38 | * Returns a logical session implementation based on the information extracted from the current HTTP request or null if that was not possible
39 | *
40 | * @param httpServletRequest current request
41 | *
42 | * @return a logical session created based on the current request or null if that was not possible
43 | */
44 | LogicalSession extract(final HttpServletRequest httpServletRequest);
45 |
46 | /**
47 | * Returns a logical session implementation based on the information extracted from the current HTTP request or creates a new one
48 | *
49 | * @param httpServletRequest current request
50 | * @return logical session implementation based on the information extracted from the current HTTP request or creates a new one
51 | */
52 | LogicalSession extractOrCreate(HttpServletRequest httpServletRequest);
53 | }
54 |
--------------------------------------------------------------------------------
/csrfguard/src/main/java/org/owasp/csrfguard/token/storage/impl/PageTokenValue.java:
--------------------------------------------------------------------------------
1 | /*
2 | * The OWASP CSRFGuard Project, BSD License
3 | * Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
4 | * All rights reserved.
5 | *
6 | * Redistribution and use in source and binary forms, with or without
7 | * modification, are permitted provided that the following conditions are met:
8 | *
9 | * 1. Redistributions of source code must retain the above copyright notice,
10 | * this list of conditions and the following disclaimer.
11 | * 2. Redistributions in binary form must reproduce the above copyright
12 | * notice, this list of conditions and the following disclaimer in the
13 | * documentation and/or other materials provided with the distribution.
14 | * 3. Neither the name of OWASP nor the names of its contributors may be used
15 | * to endorse or promote products derived from this software without specific
16 | * prior written permission.
17 | *
18 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | */
29 | package org.owasp.csrfguard.token.storage.impl;
30 |
31 | import java.time.LocalDateTime;
32 |
33 | public final class PageTokenValue {
34 |
35 | private final String pageTokenValue;
36 | private final LocalDateTime localDateTime;
37 |
38 | private PageTokenValue(final String pageTokenValue) {
39 | this(pageTokenValue, LocalDateTime.now());
40 | }
41 |
42 | private PageTokenValue(final String pageTokenValue, final LocalDateTime localDateTime) {
43 | this.pageTokenValue = pageTokenValue;
44 | this.localDateTime = localDateTime;
45 | }
46 |
47 | public static PageTokenValue from(final String pageTokenValue) {
48 | return new PageTokenValue(pageTokenValue);
49 | }
50 |
51 | public static PageTokenValue from(final String pageTokenValue, final LocalDateTime localDateTime) {
52 | return new PageTokenValue(pageTokenValue, localDateTime);
53 | }
54 |
55 | public String getValue() {
56 | return this.pageTokenValue;
57 | }
58 |
59 | public LocalDateTime getCreationTime() {
60 | return this.localDateTime;
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/csrfguard/src/main/java/org/owasp/csrfguard/token/transferobject/TokenTO.java:
--------------------------------------------------------------------------------
1 | /*
2 | * The OWASP CSRFGuard Project, BSD License
3 | * Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
4 | * All rights reserved.
5 | *
6 | * Redistribution and use in source and binary forms, with or without
7 | * modification, are permitted provided that the following conditions are met:
8 | *
9 | * 1. Redistributions of source code must retain the above copyright notice,
10 | * this list of conditions and the following disclaimer.
11 | * 2. Redistributions in binary form must reproduce the above copyright
12 | * notice, this list of conditions and the following disclaimer in the
13 | * documentation and/or other materials provided with the distribution.
14 | * 3. Neither the name of OWASP nor the names of its contributors may be used
15 | * to endorse or promote products derived from this software without specific
16 | * prior written permission.
17 | *
18 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | */
29 | package org.owasp.csrfguard.token.transferobject;
30 |
31 | import com.google.gson.Gson;
32 | import org.apache.commons.lang3.StringUtils;
33 |
34 | import java.util.Collections;
35 | import java.util.Map;
36 |
37 | public class TokenTO {
38 |
39 | private final String masterToken;
40 |
41 | private final Map