Completed
Second Defensive Option is Double Submit Cookies This option used less often, but useful for things like REST
Class Central Classrooms beta
YouTube videos curated by Class Central.
Classroom Contents
CSRF Defense Strategies - Not All Are Created Equal
Automatically move to the next video in the Classroom when playback concludes
- 1 Intro
- 2 If you can predict all the parameters for an action, you can fake it
- 3 High Level Defenses (Design Patterns)
- 4 Primary Defense is the Synchronizer Token Pattern
- 5 Second Defensive Option is Double Submit Cookies This option used less often, but useful for things like REST
- 6 A Third Option is Any Form of Challenge Response System Rarely Used Exclusively for CSRF Defense
- 7 CSRFGuard Implements the Synchronizer Token Pattern and Makes a New Token For Each Session
- 8 Tomcat 7 Includes a CSRF Prevention Filter
- 9 F5's ASM Can Insert a Token in All Links and Forms to Implement the Synchronizer Token Pattern
- 10 Imperva Secure Sphere Can Detect CSRF Attacks by Checking the Referrer Header
- 11 CSRF Token Names Can Reveal What Library You Are Using
