Re: HTML_QuickForm CSRF

On Thu, Apr 9, 2009 at 8:59 PM, Dmitri Snytkine <d.snytkine@gmail.com>wrote: > Hello! > > Does anyone know simple steps to make forms generated with HTML_QuickForm > secure against the CSRF attacks? > > Any suggestions? > > > A better question for all developers: I wrote a simple class that extends the HTML_QuickForm and its designed to protect against the CSRF the goal was to make it all automatic and transparant, so end-user does not have to even worry about it. The generated form will automatically have the hidden field qf_version and its value is automatically added to SESSION, then upon the form submit a check is performed to see that qf_version matches the value in SESSION and also matches the ip address - form must be submitted from the same IP from where the original page with that form has been requested. and one last check is that hidded field 'a' is used for validation. This 'a' field is specific to my site design. 'a' stands for action, for example 'a' = edit-profile means a form is used for editing profile 'a' = register means form is used for registration, etc. This extra check means that a security token is generated per specific 'a' value, so a token for a form 'register' is different from token for a form 'edit-profile' Anyway, I want developers to take a look and tell me if this would help with protecting against CSRF Here is the link to web based source browser for this class: http://dev.sharedlog.com/svn/trunk/classes/clsQuickForm.php