Robots Dreams | Entries with Tag "Web Application Firewall

CSRF Token

A CSRF token (Cross-Site Request Forgery token) is a security measure used to prevent Cross-Site Request Forgery (CSRF) attacks. CSRF is a type of attack where an attacker tricks a user into performing unwanted actions in a web application while the user is already logged into the application.

The CSRF token is a randomly generated value assigned to each user during their session. This token is typically used in the form of a hidden field in web forms or as part of URL parameters in AJAX requests. When the user performs an action, the web application checks if the submitted CSRF token matches the expected token. If the tokens match, the request is considered legitimate and processed. Otherwise, the request is rejected.

By using CSRF tokens, web applications can ensure that the actions performed originate from the authorized user and not from an attacker attempting to exploit a user's session. This helps to maintain the integrity and security of the application.

Created 6 Months ago

Web Application Firewall - WAF

A web application firewall (WAF) is a security solution that has been specially developed to protect web applications. It monitors traffic between web browsers and web applications to detect and block potentially harmful or unwanted activity. Essentially, a WAF acts as a shield that protects web applications from a variety of attacks, including

SQL injection: an attack technique where attackers inject malicious SQL queries to access or manipulate the database.
Cross-site scripting (XSS): An attack method where attackers inject scripts into websites to compromise users, such as by stealing session cookies or performing malicious actions on the user's behalf.
Cross-site request forgery (CSRF): An attack in which an attacker makes a fraudulent request on behalf of an authenticated user to perform unwanted actions.
Brute force attacks: Repeated attempts to log into a system using stolen or guessed credentials.
Distributed Denial of Service (DDoS): Attacks in which a large number of requests are sent to a web application in order to overload it and make it inaccessible.

A WAF analyzes HTTP and HTTPS traffic and applies specific rules and filters to identify and block suspicious activity. It can be implemented both at server level and as a cloud-based solution and is an important part of a comprehensive security strategy for web applications.