A8 – Preventing CSRF
When Web applications don't use a per-session or per-operation token or if the token is not correctly implemented, they may be vulnerable to cross-site request forgery and an attacker may force authenticated users to do unwanted operations.
CSRF is the eighth most critical vulnerability in Web applications nowadays, according to OWASP, and we will see how to prevent it in our applications in this recipe.
How to do it...
The first and the most practical solution for CSRF is to implement a unique, per-operation token, so every time the user tries and executes an action, a new token is generated and verified server-side.
The unique token should not be easily guessable by an attacker; so they can't include it in the CSRF page. Random generation is a fine choice here.
Include the token to be sent in every form that could be a target for CSRF attacks. "Add to cart" requests, password change forms, e-mail, contact, or shipping information management and money transfer in banking...
