Re: Cross-Site Request Forgeries

[Emilio Casbas <ecasbas () s21sec com>]

Ricardo Tiago escribió:
> Hi,
>
> What methods exist to protect against Cross-Site Request Forgeries?
> And what is the most efficient one?

- Inspecting Referer headers (it could be forged)
- Validation via user-provided secret (ask for password for important 
transactions)
- Validation vía "action token" (in order to distinguish the genuine
  url from the forged.). The most efficient.

Take a look:
http://www.cgisecurity.com/articles/csrf-faq.shtml

Regards
Emilio.