Cross-site Request Forgery protection in web application( Used SynchronizerTokenPattern )
In this project used Synchronizer Token Pattern to avoid Cross-site Request Forgery protection in a web application. The application consists of a simple login page with hard-coded credentials. Upon login generates CSRF token and store in server side. The Website has an endpoint which accepts HTTPS post requests. The endpoint receives the session cookie and based on the session identifier, return the CSRF token value. The HTML is submitted to the action, on the server side, extract the received CSRF token value and check if it is the correct token issued for the particular session. If the received CSRF token is valid, show a success message. If not show an error message.
git clone https://github.com/AnuradhaSD/CSRF_SynchronizerTokenPattern.git
- Application Implemented Using Eclipse IDE
- Appache TomCat Should be Configured(Used Tomcat V7.0)
localhost:8080/CSRF/login.jsp
UserName :asd
Password :123
Upon Sceessful login directs to Form
localhost:8080/CSRF/form.jsp