blocks|key|2770721|text|他们发现了两个不同的问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2770722|Cookie是对建立连接的客户端计算机进行身份验证。|2770723|隐藏表单字段用于验证表单的来源。|2770724|示例场景:用户A，在客户端机器上可以对表单进行书签。用户B登录，从今天起获得一个有效的cookie。当浏览器拥有用户B会话的遗留cookie时，用户A可以从昨天开始提交无效的表单字段。|2770725|哪些客户端/浏览器资源通常被破坏，|blockquote|2770726|没有。|2770727|这些csrf字段是如何帮助保护我们免受伪造请求的呢？|2770728|CSRF令牌建立身份。|2770729|一个(而且只有一个)浏览器有一个CSRF+cookie令牌。但是，该浏览器可以有多个网站副本打开或书签的表单。|2770730|该浏览器上的一个(而且只有一个)页面窗体具有CSRF表单令牌。|2770731|浏览器和表单cookie必须匹配，以确保一个浏览器/一个表单。|2770732|entityMap^0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|11|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|12|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|13|8|@]|9|@]|A|$]]|$1|M|3|N|5|J|7|14|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|15|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|16|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|17|8|@]|9|@]|A|$]]|$1|U|3|V|5|6|7|18|8|@]|9|@]|A|$]]|$1|W|3|-4|5|6|7|19|8|@]|9|@]|A|$]]]|X|$]]

They spot two different problems.

Cookie is to authenticate the client machine making the connection.

The hidden form field is to authenticate the source of the form.

Example Scenario: User A, on the client machine could bookmark the form. User B logs on, gets a valid cookie from today. User A could submit the invalid form field from yesterday when the browser has a left-over cookie from user B's session.

<hr>

<blockquote>
 what client/browser resources are typically compromised, 
</blockquote>

None.

<blockquote>
 and how is it that these csrf fields help protect us from the forgery requests?
</blockquote>

The CSRF tokens establish identity. 

One (and only one) browser has a CSRF cookie token. But that browser could have multiple copies of a site open or bookmarked forms.

One (and only one) page form on that browser has a CSRF form token. 

The browser and form cookies must match to assure one browser/one form.

blocks|key|1214305|text|cookie是为了支持AJAX而存在的。引用姜戈博士|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1214306|虽然上面的方法可以用于AJAX+POST请求，但它有一些不便之处:您必须记住将CSRF令牌作为POST数据与每个POST请求一起传递。因此，有另一种方法:在每个XMLHttpRequest上，将一个定制的alternative报头设置为CSRF令牌的值。这通常更容易，因为许多javascript框架提供了允许在每个请求上设置头的挂钩。在jQuery中，您可以按照以下方式使用ajaxSend事件：|blockquote|1214307|$('html').ajaxSend(function(event,+xhr,+settings)+{
++++function+getCookie(name)+{
++++++++var+cookieValue+=+null;
++++++++if+(document.cookie+&&+document.cookie+!=+'')+{
++++++++++++var+cookies+=+document.cookie.split(';');
++++++++++++for+(var+i+=+0;+i+<+cookies.length;+i%2B%2B)+{
++++++++++++++++var+cookie+=+jQuery.trim(cookies[i]);
++++++++++++++++//+Does+this+cookie+string+begin+with+the+name+we+want?
++++++++++++++++if+(cookie.substring(0,+name.length+%2B+1)+==+(name+%2B+'='))+{
++++++++++++++++++++cookieValue+=+decodeURIComponent(cookie.substring(name.length+%2B+1));
++++++++++++++++++++break;
++++++++++++++++}
++++++++++++}
++++++++}
++++++++return+cookieValue;
++++}
++++if+(!(/%5Ehttp:.*/.test(settings.url)+%7C%7C+/%5Ehttps:.*/.test(settings.url)))+{
++++++++//+Only+send+the+token+to+relative+URLs+i.e.+locally.
++++++++xhr.setRequestHeader("X-CSRFToken",+getCookie('csrftoken'));
++++}
});|code-block|syntax|javascript|1214308|将此添加到站点中包含的javascript文件将确保通过jQuery发出的AJAX请求不会被CSRF保护捕获。|1214309|entityMap|0|LINK|mutability|MUTABLE|url|http://docs.djangoproject.com/en/1.7/ref/contrib/csrf/#ajax^0|M|4|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]|$1|D|3|E|5|F|7|Z|8|@]|9|@]|C|$]]|$1|G|3|H|5|I|7|10|8|@]|9|@]|C|$J|K]]|$1|L|3|M|5|F|7|11|8|@]|9|@]|C|$]]|$1|N|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|O|$P|$5|Q|R|S|C|$T|U]]]]

The cookie is there for AJAX support. Quoting the <a href="http://docs.djangoproject.com/en/1.7/ref/contrib/csrf/#ajax" rel="nofollow noreferrer">Django docs</a>:

<blockquote>
 While the above method can be used for AJAX POST requests, it has some inconveniences: you have to remember to pass the CSRF token in as POST data with every POST request. For this reason, there is an alternative method: on each XMLHttpRequest, set a custom X-CSRFToken header to the value of the CSRF token. This is often easier, because many javascript frameworks provide hooks that allow headers to be set on every request. In jQuery, you can use the ajaxSend event as follows:
</blockquote>

<pre><code>$('html').ajaxSend(function(event, xhr, settings) {
 function getCookie(name) {
 var cookieValue = null;
 if (document.cookie &amp;&amp; document.cookie != '') {
 var cookies = document.cookie.split(';');
 for (var i = 0; i &lt; cookies.length; i++) {
 var cookie = jQuery.trim(cookies[i]);
 // Does this cookie string begin with the name we want?
 if (cookie.substring(0, name.length + 1) == (name + '=')) {
 cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
 break;
 }
 }
 }
 return cookieValue;
 }
 if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
 // Only send the token to relative URLs i.e. locally.
 xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
 }
});
</code></pre>

<blockquote>
 Adding this to a javascript file that is included on your site will ensure that AJAX POST requests that are made via jQuery will not be caught by the CSRF protection.
</blockquote>

blocks|key|2770807|text|杰夫·阿特伍德的博客文章：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2770808|防止CSRF和XSRF攻击(2008年10月14日)|2770809|原来的职位|offset|length|2770810|Felten和Zeller论文(pdf)建议采用“双重提交的cookie”方法来防止XSRF：|2770811|当用户访问一个站点时，该站点应该生成一个(加密强的)伪随机值，并将其设置为用户机器上的cookie。站点应该要求每个表单提交都将这个伪随机值作为表单值和cookie值来包含。当将POST请求发送到站点时，只有在表单值和cookie值相同的情况下，才应认为请求是有效的。当攻击者代表用户提交表单时，他只能修改表单的值。攻击者无法根据相同的来源策略读取从服务器发送的任何数据或修改cookie值。这意味着，虽然攻击者可以通过表单发送他想要的任何值，但他将无法修改或读取存储在cookie中的值。由于cookie值和窗体值必须相同，除非攻击者能够猜出伪随机值，否则将无法成功提交表单。
这种方法的优点是它不需要服务器状态；只需设置一次cookie值，然后每个HTTP检查，以确保提交的一个值包含完全相同的cookie值。两者之间的任何差异都意味着可能存在XSRF攻击。|blockquote|2770812|entityMap|0|LINK|mutability|MUTABLE|url|http://www.codinghorror.com/blog/2008/10/preventing-csrf-and-xsrf-attacks.html^0|0|0|0|5|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@$F|X|G|Y|1|Z]]|A|$]]|$1|H|3|I|5|6|7|10|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|11|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

From Jeff Atwood's blog entry: 

Preventing CSRF and XSRF Attacks
(Oct 14, 2008)

<a href="http://www.codinghorror.com/blog/2008/10/preventing-csrf-and-xsrf-attacks.html">The original post</a>

The Felten and Zeller paper (pdf) recommends the "double-submitted
 cookie" method to prevent XSRF: 

<blockquote>
 When a user visits a site, the site should generate a
 (cryptographically strong) pseudorandom value and set it as a
 cookie on the user's machine. The site should require every form
 submission to include this pseudorandom value as a form value and
 also as a cookie value. When a POST request is sent to the site,
 the request should only be considered valid if the form value and
 the cookie value are the same. When an attacker submits a form on
 behalf of a user, he can only modify the values of the form. An
 attacker cannot read any data sent from the server or modify cookie
 values, per the same-origin policy. This means that while an
 attacker can send any value he wants with the form, he will be
 unable to modify or read the value stored in the cookie. Since the
 cookie value and the form value must be the same, the attacker will
 be unable to successfully submit a form unless he is able to guess
 the pseudorandom value.
 
 The advantage of this approach is that it requires no server state;
 you simply set the cookie value once, then every HTTP POST checks to
 ensure that one of the submitted values contains the exact
 same cookie value. Any difference between the two means a possible
 XSRF attack.
</blockquote>

Trying to learn about security. Curious about why in django when
submitting a form (a POST), there are 2 separate "elements" that
contain the same csrf token value:

<pre><code>- the csrftoken cookie:
 COOKIES:{'csrftoken': '1effe96056e91a8f58461ad56c0d4ddc', ...

- the Form's hidden csrfmiddlewaretoken:
 POST:&lt;QueryDict: {u'csrfmiddlewaretoken': 
 [u'1effe96056e91a8f58461ad56c0d4ddc'], ...
</code></pre>

If django is inserting the hidden csrf field/value to
the form when it sends it to the browser (GET), and expects the 
same value back when receiving the POST, then why is it 
necessary to also set a cookie?

A more general question, if either of them was missing (form, cookie),
could you provide a scenario that explains how this could be exploited 
(security attack)?

By the way, I ran a couple of simple tests to make sure that 
django was checking the validity of each one separately and 
indeed it is: 

<ul>
<li>if I change the form's csrf value before doing the POST, 
I get this debug error back: 

CSRF token missing or incorrect</li>
<li>if I delete the csrf cookie before doing the POST, 
I get a different error back: 

CSRF cookie not set.</li>
</ul>

I'm just familiar with basic csrf concepts and want to 
learn how django helps protect against these types of attacks.

Thanks,

jd

<hr>

update: 

Although both answers (S.Lott and M. DeSimone) were informative and 
make sense, I thought that there could be a more detailed explanation 
for requiring the presence of the security value in both the form and 
in the cookie. While searching outside stackoverflow.com, I came across
a blog post from...Jeff Atwood.

I have included a third answer (sorry to answer my own question but
I think that it is relevant supplemental info) that refers to a blog
post from Jeff and includes a quotation.

django: csrftoken COOKIE vs. csrfmiddlewaretoken HTML Form value

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

试着学习安全知识。出于好奇为什么在django中提交表单( POST)时，有两个单独的“元素”包含相同的csrf令牌值：- the csrftoken cookie:     COOKIES:{'csrftoken': '1effe96056e91a8f58461ad56c0d4ddc', ...- the Form'...

问django: csrftoken与csrfmiddlewaretoken表单值
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问django: csrftoken与csrfmiddlewaretoken表单值EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问django: csrftoken与csrfmiddlewaretoken表单值
EN