Re: blocking CSRF attacks

[makkalot () gmail com]

Tuesday 11 December 2007 Tarihinde 11:35:36 yazmıştı:
> Hi List,
Hi :)
> any one on the list aware of any IDS/IPS capable of blocking CSRF
> attacks?
I dont think you need to block them with ids or ips. 
> If not, what will be the best policy to block CSRF.
It is actually a problem of your web framework or application you use. CSRF 
attacks use easy to guess URL'S. Therefore you shouldnt use GET for important 
tasks in your site. And also for POST requests you may use randomly generated 
hidden fields in your forms when you submit something. 

You may checkout that : http://www.owasp.org/index.php/CSRF




-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be 
considered a crucial phase in the development of any web application. What methodology should be followed? What tools 
can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------