CSFR protection of HTML forms

CSFR is a technology to prevent unauthorized submission of a form. Its essence is that a unique ID is generated for each form and user and is contained in the HTML code of the page. This ID is known only by the one who opened the HTML, therefore, it is inaccessible to the attacker. When submitting the form, this ID is verified on the server side. Thus, the attacker cannot send a request to the site on behalf of the user.

An example of how CSFR protection works:

<form action="." method="post">
    /* The _csrf field contains a special verification code that is unique for each page */
    <input type="hidden" name="_csrf" value="4B01Wfyq7mFSfPR-tSzZFTUJdocsowAfyFUSPYJ_EZiKLlIAqfCYE2AYkh3PfIFze19E4RSVSymPEiRT0A1ryA==">
    <input type="text" name="login">
    <input type="password" name="login">
    <input type="submit">
</form>

The CSFR attack is extremely popular. Implement CSFR protection on your project.

Detailed simple описание. Detailed technical description.

PRO subscription for working with the service

Learn more about pricing plans