Comments on: Cross-Site Request Forgeries (CSRF) http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/ One developers blog. Fri, 03 Feb 2012 16:12:21 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: artikelverzeichnis http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-99348 artikelverzeichnis Sun, 22 Jan 2012 04:14:19 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-99348 An interesting dialogue is value comment. I think that you must write more on this topic, it won't be a taboo subject however usually people are not sufficient to talk on such topics. To the next. Cheers An interesting dialogue is value comment. I think that you must write more on this topic, it won’t be a taboo subject however usually people are not sufficient to talk on such topics. To the next. Cheers

]]> By: Leticia Schlotfeldt http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-99275 Leticia Schlotfeldt Sat, 21 Jan 2012 19:51:07 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-99275 I simply wanted to develop a message to thank you for the precious ideas you are giving out at this website. My incredibly long internet search has at the end been honored with reliable information to share with my partners. I would assert that we site visitors actually are really lucky to be in a remarkable community with many lovely individuals with very helpful tricks. I feel somewhat lucky to have seen the site and look forward to really more thrilling times reading here. Thanks a lot once more for all the details. I simply wanted to develop a message to thank you for the precious ideas you are giving out at this website. My incredibly long internet search has at the end been honored with reliable information to share with my partners. I would assert that we site visitors actually are really lucky to be in a remarkable community with many lovely individuals with very helpful tricks. I feel somewhat lucky to have seen the site and look forward to really more thrilling times reading here. Thanks a lot once more for all the details.

]]> By: U238 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-1062 U238 Wed, 23 Jul 2008 20:00:46 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-1062 Good tutorial , thnx bro. Good tutorial , thnx bro.

]]> By: Christopher http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-971 Christopher Sat, 05 Jul 2008 13:16:11 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-971 Remember that the goal isn't about creating a unique hash (though for all intents and purposes, it will be unique), the goal is to simply create a hash that is unguessable within the time the code is valid (say, 10 minutes). While it is true that a random number and microtime isn't 100% secure (for reasons that mt_rand() can be predicted under the right conditions), it is nevertheless a pretty good way. You can add a secret salt to the mix if you want more security. Remember that the goal isn’t about creating a unique hash (though for all intents and purposes, it will be unique), the goal is to simply create a hash that is unguessable within the time the code is valid (say, 10 minutes).

While it is true that a random number and microtime isn’t 100% secure (for reasons that mt_rand() can be predicted under the right conditions), it is nevertheless a pretty good way. You can add a secret salt to the mix if you want more security.

]]> By: Albert http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-927 Albert Fri, 04 Jul 2008 20:49:06 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-927 You should use something like <code>md5(uniqid(rand(0, 99999999), true))</code> to generate a unique token, because <code>mt_rand(0, 1000)</code> has just 1000 possibilities. You should use something like md5(uniqid(rand(0, 99999999), true)) to generate a unique token, because mt_rand(0, 1000) has just 1000 possibilities.

]]> By: syshoLe.com » Blog Archive » CSRF Saldırıları ve Korunma (Bölüm 2) http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/comment-page-1/#comment-238 syshoLe.com » Blog Archive » CSRF Saldırıları ve Korunma (Bölüm 2) Mon, 03 Dec 2007 10:24:45 +0000 http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/#comment-238 [...] http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/ [...] [...] http://devlog.info/2007/09/02/cross-site-request-forgeries-csrf/ [...]

]]>