HTML5的CSRF攻击与防御技术研究  

Research on CSRF Attack and Defense Technology Based on HTML5

作　　者：李立 原建伟[1] LI Li;YUAN Jianwei(College of Information Engineering, Shaanxi Polytechnic Institute, Xianyang 712000, China)

机构地区：[1]陕西工业职业技术学院信息工程学院,陕西咸阳712000

出　　处：《微型电脑应用》2021年第10期36-38,共3页Microcomputer Applications

基　　金：陕西省教育厅科研计划项目(16JK1057)。

摘　　要：通过建立Web服务器和HTML5环境来验证HTML5受到CSRF攻击全过程,并提出相应的CSRF漏洞检测和防御方式。在CSRF攻击验证和检测方面,通过构建攻击脚本验证CSRF攻击,并引入Rational AppScan进行CSRF漏洞检测;在CSRF攻击防御方面,提出利用验证码验证、验证HTTP Referer字段、添加token方式进行CSRF防御。可以看出,尽管提出的CSRF防御方式在很大程度抵御大部分攻击,但实际应用过程中,需要结合相关情况选定合适的防御策略来降低CSRF的危害。This paper verifies the whole process of HTML5 CSRF attack by establishing Web server and HTML5 environment,and puts forward the corresponding detection and defense methods of CSRF vulnerability.On the CSRF attack verification,CSRF attack is carried out by constructing the attack script verification GET POST which breaks through the restriction of homologous strategy.Scan carries out CSRF vulnerability detection.In the aspect of CSRF attack defense,it is proposed to use verification code verification,verification HTTP Referer field,add token to carry out CSRF defense.Although the proposed CSRF defense mode is largely resistant to most attacks,in practical application,it is necessary to select appropriate defense strategies in combination with relevant circumstances to reduce the harm of CSRF.

关 键 词：CSRF攻击 HTML5 WEB应用 漏洞检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]