Completed
High Level Defenses (Design Patterns)
Class Central Classrooms beta
YouTube videos curated by Class Central.
Classroom Contents
CSRF Defense Strategies - Not All Are Created Equal
Automatically move to the next video in the Classroom when playback concludes
- 1 Intro
- 2 If you can predict all the parameters for an action, you can fake it
- 3 High Level Defenses (Design Patterns)
- 4 Primary Defense is the Synchronizer Token Pattern
- 5 Second Defensive Option is Double Submit Cookies This option used less often, but useful for things like REST
- 6 A Third Option is Any Form of Challenge Response System Rarely Used Exclusively for CSRF Defense
- 7 CSRFGuard Implements the Synchronizer Token Pattern and Makes a New Token For Each Session
- 8 Tomcat 7 Includes a CSRF Prevention Filter
- 9 F5's ASM Can Insert a Token in All Links and Forms to Implement the Synchronizer Token Pattern
- 10 Imperva Secure Sphere Can Detect CSRF Attacks by Checking the Referrer Header
- 11 CSRF Token Names Can Reveal What Library You Are Using
