Blog

CSRF Security Module: Not All Surfing Is Good

Nathaniel Francis February 20, 2015

Spread the word

Nathaniel Francis

February 20, 2015

Spread the word


Share your thoughts

Welcome to the jungle

Remember a time when the internet was a safe place. Where your email wasn't getting hacked every 3 months, nobody wanted to XSS something malicious to you or through you, and no one conceived of encrypting your hard drive for money?

I don't either. Since its inception, the internet has been a jungle of security complications.

CSRF: not the good kind of surfing

This discussion could quickly dive into a host of security complications and safety precautions that we, as developers should be paying attention to. Instead, I'm going to focus on one security breach and a modular technique that ColdBox 4.0 provides to help us developers fight against it.

CSRF aka "Cross-Site Request Forgery", commonly pronounced "sea-surf", is a web exploitation where the offender violates the trust between a website and a user's browser. I know that's vague. There are various forms that CSRF takes, but they all boil down to the website being violated by the user's browser in some way, shape, or form. This is just the basic idea. The whole story is worth a decent Google search.

We got a module for that!

As with any multi-faceted security aspect, there is no singular answer. If a burglar can come into your house through either the window or the door, you may want to shut and lock both, or get a guard dog, or move. However, with CSRF security violations, there is one common flaw. The violation of trust comes from triggering actions on your site without your consent. That we can handle.

The ColdBox Cross Site Request Forgery (CSRF) Tokens module generates tokens that generate a verification, "secret handshake" system between your server and the browser. This added layer of security is subtle, but powerful in CSRF violations because it prevents a foreign agent from violating the trust between browser and server.

To install the ColdBox Cross Site Request Forgery (CSRF) Tokens module, simply go to CommandBox and enter:

box install cbcsrf

The ReadMe for this module includes the following simple example of how to use the CSRF module's functionality:

component {
    any function signUp(event, rc, prc) {
        // Store this in a hidden field in the form
        prc.token = generateCSRFToken();
    }

    any function signUpProcess(event, rc, prc) {
        // Verify CSFR token from form
        if(verifyCSRFToken(rc.token) {
            // save form
        } else {
            // Something isn't right
            setNextEvent( 'handler.signup' );
        }
    }
}

The ColdBox Cross Site Request Forgery (CSRF) Tokens module is a simple, elegant solution to a common security problem.

Add Your Comment

Recent Entries

Protect Your Data with Proactive Database Security Management

Protect Your Data with Proactive Database Security Management

In today’s digital age, data is among the most valuable assets for businesses. It powers decision-making, customer engagement, and operational efficiency. However, as data volumes grow, so do the risks associated with managing it. Ensuring database security and compliance is no longer optional—it’s a necessity.


The Evolving Landscape of Database Security

Modern databases face a myriad of challenges, from increasingly sophisticated cyber threats to strin...

Cristobal Escobar
Cristobal Escobar
December 06, 2024
The Experts Driving BoxLang: The Team Behind the Revolution

The Experts Driving BoxLang: The Team Behind the Revolution

Introduction

BoxLang is not just another programming language; it’s a revolutionary step forward for JVM environments. But who are the minds behind this innovation? Meet the talented team of architects, developers, and engineers who have combined decades of experience to create BoxLang—a language built for scalability, performance, and efficiency. Let’s explore their ex...

Cristobal Escobar
Cristobal Escobar
December 04, 2024
Why BoxLang is the Modern Software Development Evolution You’ve Been Waiting For?

Why BoxLang is the Modern Software Development Evolution You’ve Been Waiting For?

In today’s software landscape, developers need tools that deliver flexibility, efficiency, and modernization. With decades of open-source expertise, Ortus Solutions introduces BoxLang—our most ambitious project yet. Built for the JVM, BoxLang integrates seamlessly with Java, offering powerful features for scalable, high-performance web applications. Fully compatible with CFML, it ensures a smooth transition and expanded capabilities for existing projects.

Maria Jose Herrera
Maria Jose Herrera
December 04, 2024