I inherited some code that was recently attacked where the attacker sent repeated remote form submissions.
I implemented a prevention using a session auth token that I create for each user (not the session id). While I realize this specific attack is not CSRF, I adapted my solution from these posts (albeit dated).
- https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
- http://tyleregeto.com/a-guide-to-nonce
- http://shiflett.org/articles/cross-site-request-forgeries
However, it still feels there is some vulnerability here. While I understand nothing is 100% secure, I have some questions:
- Couldn't a potential attacker simply start a valid session then include the session id (via cookie) with each of their requests?
- It seems an nonce would be better than session token. What's the best way to generate and track an nonce?
- I came across some points about these solutions being only single window. Could someone elaborate on this point?
- Do these solutions always require a session? Or can these tokens be created without a session? UPDATE, this particular page is just a single page form (no login). So starting a session just to generate a token seems excessive.
- Is there a simpler solution (not CAPTCHA) that I could implement to protect against this particular attack that would not use sessions.
In the end, I am looking for a better understanding so I can implement a more robust solution.