BNavin118206 (Community Member) asked a question.
i am getting CSRF vulnerbilitiy in login form.how can i add CSRF token in form and in javascript.
in java how to use this token to help in unwanted request.please let me know
thank you
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Hi @BNavin118206 (Community Member) ,
This depends very much on your specific technology stack. Could you share what technologies you're using?
For example, as you mention JavaScript, for NodeJS with ExpressJS we'd recommend the csurf library: http://expressjs.com/en/resources/middleware/csurf.html .
Thank you,
Boy Baukema
Hi Hemanth,I am using standard java script,just explain how can I add token in JSP page and how to validate the token at server side.
Hi @BNavin118206 (Community Member) ,
If you are using .NET MVC, then it is pretty much simple, you need to use HTML helper @Html.AntiForgeryToken() in view. It should be placed inside the BeginForm() method in your view and then we need to add [ValidateAntiForgeryToken] attribute on the action method which will accept HTTP POST request. We need to do only these 2 changes and then MVC will prevent from CSRF attacks.
Hope this helps you. If you are using different technology stack then please describe. what you are using.
Thank you
Hemant
I am from Java ,I am using spring MVC
Hi @BNavin118206 (Community Member) ,
Spring Security should be enabled by default, please ensure you have not disabled csrf protection, you can find more on this (external) page: https://www.baeldung.com/spring-security-csrf#config .
There you can also find how to add the CSRF token.
Thank you,
Boy Baukema
How to validate csrf token in server side means in java file
@BNavin118206 (Community Member) , Can you see if the following link helps you to validate csrf token at server side?
Stack overflow
Thanks,
Hemant