基于浏览器的跨站攻击防御系统  

Cross-Site Against Defense System Based on Browser

作　　者：刘昆[1] 何文婷[2] 何博远[2] 

机构地区：[1]四川大学软件学院,成都610225 [2]四川大学计算机学院,成都610225

出　　处：《现代计算机（中旬刊）》2011年第7期43-45,共3页Modern Computer

摘　　要：提出一种基于客户端,即用户浏览器的防御跨站攻击的思路,首先在用户浏览器编写插件拦截所有的HTTP请求,然后通过分析判断出该请求是不是跨站请求,再由独立的规则服务器向浏览器插件分发规则,借助排除其中允许的跨站请求,那么剩下的跨站请求即可以认为是恶意的、不被允许的跨站伪造请求,然后弹出对话框向用户告警,拦截该HTTP请求。Proposes an idea based on client which defenses cross-site attack.First uses browser plugin to stop all HTTP request,then analyses whether the request is cross-site attack or not,then the rule server distributes the independent rules to browser plugin.So the rest of the cross-site request can be considered to be malicious and not allowed cross-site request if we get rid of the allowed request.At last,browser popups dialog box to inform the user and intercepts the HTTP request.

关 键 词：跨站请求伪造攻击 防御系统 规则服务器 浏览器插件 

分 类 号：TP393.092[自动化与计算机技术—计算机应用技术]