CSRF仅适用于Ajax

Question

I have recently been working with a way to stop CSRF attacks happening by using a token. To my understanding:

1) User logs in, set session cookie to logged in and generate CSRF token and save it to the session

2) User submits form (with token) and it should match the token in session

Hypothetically lets say I have page1.php which has a sql SELECT to get all the users account information and then within the same page I also have an ajax button to page2.php which changes the account information. Obviously I protect page2.php from CSRF (because this is a post request) but how do I protect against page1.php? If this page was to get called from a remote source by ajax or putting an iframe on an attackers website, surely this would print all of the victims account information?

If this is the case how come I can't seem to find anything on protecting all pages from CSRF attacks and I only find resources for protecting against CSRF attacks in ajax?

Answer 1

I am not sure I get the point but the token for CSRF should be a nonce, which changes on each call.

Regarding a call coming from some other place, the ajax request should also check that the call comes from a valid user with the correct entitlments as you would do with any "regular" call to the site.

If this is the case how come I can't seem to find anything on protecting all pages from CSRF attacks and I only find resources for protecting against CSRF attacks in ajax?

What you ussually do is to set a nonce in a hidden input of the forms you use in "regular" pages.