How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

Question

What is CSRF?

I need a basic definition that is not just lifted from Wikipedia.

I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.

I am using a framework, CakePHP, that has a component that automatically prevent this CSRF. However, whenever I do something to the form like using jQuery to alter the values of the field. Or when I include some Ajax that works with Flash plugins like Uploadify, I need to disable CSRF.

SO how do I, in principle get to prevent CSRF when such elements are involved in the form?

Answer 1

CSRF or Cross-Site Request Forgery is basically a bad person tricking a good person's browser into performing functions on your website on the bad persons behalf.

Here is an example:

1. Good user logs into your website and obtains a valid session
2. Bad user tricks good user into following a link to a malicious site
3. Malicious site contains a form with falsified data which posts to your website (however since it's sent from client side, your site thinks it originated from the good user)
4. Your site then see's the good user submitted a form and processes the action.

Let's put it into context:

1. Good user is an administrator on your website.

2. From the admin panel, good user can add a user by filling out a form that looks like this:

   <form action="/new_user.php" name="myform" method="POST">
       <input type="text" name="new_username">
       <input type="password" name="new_password">
       <input type="Submit">
   </form>
   

3. Good user follows a link to a malicious site, which contains the following javascript:

   <form action="http://www.yoursite.com/new_user.php" name="myform" method="POST">
       <input type="hidden" name="new_username" value="MaliciousHax0r">
       <input type="hidden" name="new_password" value="MaliciousPass">
   </form>
   <script type="text/javascript">
       document.myform.submit();
   </script>
   

4. Your application now receives the request which was submitted by Good user, on Bad user's behalf. Since it originated from Good user, who happens to be logged into your website, all is well and your website processes the request.

Now keep in mind this is a simple example, and the Good user would see the submit happen which SHOULD raise a red flag, however using slightly more complex methods, such as XMLHttpRequest() in javascript would be silent/unknown to the Good user.

Bad user has now obtained an account on your system.

How to eliminate CSRF:

1. The trick is to add a token to each form that has a random value which is generated for each request.
2. When the form is submitted, your application checks to make sure the token is passed, and matches the random one which was generated when the form was loaded.

The malicious site wouldn't have access to this token, therefore it wouldn't be able to provide that required peice, and a form submission would not be processed.

How to make other tools work without disabling CSRF protection in CakePHP:

I don't know. Check documentation for the CSRF protection, for CakePHP, and for the other addons.

Question whether or not using those addons is worth the loss in CSRF protection, and consider alternate solutions.

CSRF Resource:

https://www.fortify.com/vulncat/en/vulncat/javascript/csrf.html