dpb35161
2016-10-28 04:29
浏览 51
已采纳

Laravel的CSRF令牌有哪些替代品？

For non-PHP based web-clients (JSON) making use of Laravel Controllers; What would be the potential alternatives to CSRF tokens in Laravel to secure web requests?

图片转代码服务由CSDN问答提供 功能建议

对于使用Laravel控制器的非基于PHP的Web客户端（JSON）; Laravel中用于保护Web请求的CSRF令牌的潜在替代方案是什么？

  • 写回答
  • 赞 踩
  • 关注问题
  • 收藏
  • 邀请回答

2条回答 默认 最新

  • dounang1974 2016-10-28 09:40
    已采纳

    If your API uses an authentication scheme that does not depend on the authentication token being sent automatically by the browser (which practically means the token or session id is not in a cookie), your API is not vulnerable to CSRF. This includes token-based auths, unless the token is stored in a cookie.

    If cookies are used to pass auth tokens (including session ids, which is the same in this respect), you need CSRF protection for all requests that change server state (mostly data, but also logon status or privilege level for example).

    For Laravel, you need to pass the token value from the XSRF-TOKEN cookie as a request header value in X-CSRF-TOKEN. With jQuery, this is easily accomplished in any client framework by reading the cookie value and adding it to requests:

    $.ajaxSetup({
  headers: {
    'X-CSRF-TOKEN': csrfCookieValue
  }
});

    If your client is not browser based, you can implement a different protection than the one in Laravel already. OWASP has a cheat sheet on what your options are, probably double submit is the easiest to implement while being reasonably secure. In very short, you create a random token and send that to the server as a cookie and also as a request header, the server only compares whether the two (cookie and header) match. This works, because an attacker on a differnet origin (domain) cannot set or access a cookie for the application origin due to the same origin policy in browsers.

    赞 踩 打赏 评论
  • douchengchen7959 2016-10-28 09:43

    I think the whole point on using a csrf token is for use inside the app. If you are sending your request via ajax from the app itself then you can simply append the csrf_token to the request. However, if you are sending data from an external source via json then the best way would be to use oAuth to secure access to your api. Luckily laravel has already built this functionality with laravel/passport so implememting it is fairly straightforward.

    赞 踩 打赏 评论

报告相同问题？

提交

相关推荐 更多相似问题