Skip to main content

Cross-site request forgery

Need​

Protection against cross-site request forgery attacks

Context​

  • Usage of Swift for iOS and macOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of Alamofire for making HTTP requests in Swift

Description​

Non compliant code​

import UIKit
import Alamofire

class ViewController: UIViewController {
    
    @IBOutlet weak var usernameTextField: UITextField!
    @IBOutlet weak var passwordTextField: UITextField!
    
    @IBAction func loginButtonTapped(_ sender: Any) {
        let parameters: [String: Any] = [
            "username": usernameTextField.text!,
            "password": passwordTextField.text!
        ]
        
        Alamofire.request("https://example.com/login", method: .post, parameters: parameters, encoding: JSONEncoding.default)
            .responseJSON { response in
                print(response)
        }
    }
}

The above Swift code represents a simple login action in an iOS application. The code uses Alamofire library to send a POST request to the server with the user's login credentials (username and password).

However, this code is vulnerable to Cross-Site Request Forgery (CSRF) attacks. In a CSRF attack, an attacker tricks a victim into performing actions on their behalf on a web application in which they're authenticated.

In this case, the attacker could create a malicious website or email that sends a request to the https://example.com/login URL with the victim's cookie. Since the server can't distinguish this from a legitimate request, it would process the request, leading to potential unauthorized actions.

This vulnerability exists because the application does not implement any type of anti-CSRF tokens or similar mechanisms to verify the legitimacy of the request.

An anti-CSRF token is a security measure used to prevent CSRF attacks. It is a random string associated with a session, and it is used to verify that user requests are intentional and originated from their application. Without such a token, the application can't verify that the requests it receives are legitimate, leaving it open to CSRF attacks.

Steps​

  • Implement Cross-Site Request Forgery (CSRF) protection.
  • Generate and include a CSRF token in each request.
  • Verify the CSRF token on the server-side before processing the request.
  • Use a secure and random CSRF token generation mechanism.
  • Ensure that the CSRF token is unique for each user session.
  • Consider using SameSite cookies to mitigate CSRF attacks.
  • Educate users about the importance of not clicking on suspicious links or performing actions without their consent.

Compliant code​

import UIKit
import Alamofire

class ViewController: UIViewController {
    
    @IBOutlet weak var usernameTextField: UITextField!
    @IBOutlet weak var passwordTextField: UITextField!
    
    var csrfToken: String = ""
    
    override func viewDidLoad() {
        super.viewDidLoad()
        // Generate CSRF token
        csrfToken = generateCSRFToken()
    }
    
    @IBAction func loginButtonTapped(_ sender: Any) {
        let parameters: [String: Any] = [
            "username": usernameTextField.text!,
            "password": passwordTextField.text!,
            "csrfToken": csrfToken
        ]
        
        Alamofire.request("https://example.com/login", method: .post, parameters: parameters, encoding: JSONEncoding.default)
            .responseJSON { response in
                print(response)
        }
    }
    
    func generateCSRFToken() -> String {
        // Implement a secure and random CSRF token generation mechanism
        // This is just a placeholder
        return UUID().uuidString
    }
}

The above code fixes the Cross-Site Request Forgery (CSRF) vulnerability by generating a CSRF token and including it in each request. The CSRF token is generated in the viewDidLoad method and stored in the csrfToken variable. This token is then included in the parameters of the request made when the login button is tapped.

The generateCSRFToken function is a placeholder for a secure and random CSRF token generation mechanism. In a real-world application, this function should use a secure random number generator and should be unique for each user session.

On the server-side, before processing the request, the CSRF token should be verified. If the token is not valid or does not match the one stored in the user's session, the request should be rejected.

In addition to this, consider using SameSite cookies to mitigate CSRF attacks. SameSite cookies are a security measure that browsers can use to prevent CSRF attacks. They work by ensuring that cookies are only sent with requests initiated from the same site that set the cookie.

Finally, it's important to educate users about the importance of not clicking on suspicious links or performing actions without their consent. This is because CSRF attacks rely on tricking the user into performing an action without their knowledge or consent.

References​

Last updated on