Web security - CSRF (token)

CSRF And Token

Token： token , and Session,Cookie equally , It's all identity ,Token It usually exists in URL and Cookie in

Token effect ：

1, Prevent forms from being submitted repeatedly
The server receives the Token after , If and Session Same value in , At this time, the client session Medium Token Will update
2, prevent CSRF( Cross station request attack ）
give an example ：

Tectonic CSRF, because Token Why , So the attack failed

Token Production process ：

When the client requests the server page , The server will generate a random number Token Store in Session in , It will also session Send to client （ Generally by construction hidden）, The next time a client submits a request ,Token It will be submitted to the server along with the form .