Synchronizer Token Pattern

This token pattern is used to prevent CSRF (Cross-site request Forgery) which refers to an attack against authenticated web application using cookies. The impact of the attack depends on the level of permissions that the victim has. Such attacks take advantage of the fact that a website completely trusts a user once it can confirm that the user is indeed who they say they are.

Synchronizer token pattern is a technique where a token, secret and unique value for each request, is embedded by the web application in all HTML forms and verified on the server side.

Then the token is generated by the server with ensuring the uniqueness. In here server generates token per every session. In that case the attacker is unable to place a correct token in their requests to authenticate them.

A third party attacker cannot perform a CSRF attack, because cross domain AJAX calls are not possible. This means, the victim is in banker.com, and attacker.com cannot request the CSRF token from the server via an ajax, because the domain doesn’t match each other, and cross domain ajax calls are not possible as mentioned above.

• User sends GET request to a server.
• Server sets the cookie with session_id, and saving session data with the token
• Server returns HTML with a form containing token in a hidden field.
• User submits form, along with a hidden field.
• Server compares token from the submitted form (hidden field) with the token saved in the session storage. If they match, it means that form is submitted by a user.

Advantages

1. Simple to implement.
2. Works with AJAX.
3. Works with forms.
4. Cookie can actually be HTTP Only

Disadvantages

1. All forms must output the hidden field in HTML
2. Any AJAX POSTs must also include the value.
3. The page must know in advance that it requires the CSRF token so it can include it in the page content so all pages must contain the token value somewhere, which could make it time consuming to implement for a large site.

Applying Synchonizer Token Pattern in a Web Application

For the following web application PHP was used.

Get Rajitha Perera’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Initially, a login page was made with hard-coded credentials as follows.

Login Page with Hard-coded credentials

A code segment of index.php

The following screen is shown if wrong credentials are used.

Error Message

After inserting valid credentials, the user is being redirected to the follwing page. (profile.php)

Profile Page

When the users inserts the correct credentials in the login page and the user is being redirected to the profile page- the browser will create a cookie with session id with the relevant information. It can be found in the browser.

Session ID’s in browser memory

in this web application if an illegitimate user tries an invalid cookie an alert will be shown.

Find the Web application here.