kohana - CSRF，怎么煮呢？

Question

我想知道，CSRF 保护的重点是什么？我的意思是，生成 token 并将带有 token 的隐藏字段放入表单中，然后在 POST 完成后，控制这两个 token 。我正在测试我的网页以及我为解决它所做的整个事情 - 我刚刚复制了整个生成的表单(html 源代码)并更改了表单操作属性。网络机器人不是在做类似的事情，或者我只是不明白什么？如何进行有效的 CSRF 保护？

P.S 我正在使用 Kohana(安全:: token 和安全::检查)

谢谢!

Answer 1

来自 Wikipedia :

The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated. For example, one user, Bob, might be browsing a chat forum where another user, Fred, has posted a message. Suppose that Fred has crafted an HTML image element that references an action on Bob's bank's website (rather than an image file), e.g.,

<img src="http://bank.example.com/withdraw?account=bob&amount=1000000&for=Fred">

If Bob's bank keeps his authentication information in a cookie, and if the cookie hasn't expired, then the attempt by Bob's browser to load the image will submit the withdrawal form with his cookie, thus authorizing a transaction without Bob's approval.

通过在表单中​​生成并包含随机 token ，您可以通过检查发布的 token 是否与生成的 token (通常存储在用户 session 中)匹配来避免这种攻击。
小花 docs说清楚应该怎么做:

You can insert this token into your forms as a hidden field:

echo Form::hidden('csrf', Security::token());

And then check it when using Validation:

$array->rules('csrf', array(
    'not_empty'       => NULL,
    'Security::check' => NULL,
));