Isizinda esincane sokuphatha asivimbi i-CSRF: izivivinyo ezine ngaphambi kokuqalisa

Ukuthutha isixhumi sokuphatha kuya ku-admin.example.com kuwukuthuthuka kwangempela: kugcina ama-cookie okuphatha kude namakhasi omphakathi, kunikeza izinhlelo ezimbili ama-cache ahlukene futhi kukuvumela ukuthi uqondise inqubomgomo yenethiwekhi eqinile kugama elilodwa lomsingathi. Kepha akulona ukulawula kwe-CSRF, futhi akwenzi ikhodi yesiza somphakathi iphephe ukushiywa ivulekile phambi komqondisi ongenile. Ukwehlukanisa kushintsha lokho uhlelo lokuphequlula olukubona njengomngcele, hhayi lokho iseva ekuhlolayo, ngakho yenza lezi zivivinyo ezine ngaphambi kokuthi kuqediwe.

Funda ingqikithi nesiza njengamagama amabili ahlukene

Ingqikithi ishilo sokukhombisa, umsingathi kanye nechweba, ngakho https://www.example.com kanye https://admin.example.com bayizinto ezihlukene. Isiza ngomqondo we-SameSite ishilo sokukhombisa kanye nesizinda esingabhaliswa, ngakho lawo magama amabili omsingathi ngokuvamile yisiza esisodwa. Lowo mehluko uyiwona wonke umgibe: isici se-SameSite ngeke sikusize phakathi kwezizinda ezingaphansi ezingabazalwane, ngoba uhlelo lokuphequlula alukuboni isicelo njengokuwela isiza nhlobo. Qondisa isixhumi sokuphatha esizindeni esihlukile ngempela esingabhaliswa, njenge-admin-example.net, bese isicelo siba ngempela esiwela isiza, futhi yilapho i-SameSite=Lax noma i-Strict iqala ukwenza umsebenzi ongawethemba.

Kuhlola lokhu kusiphequluli esikhundleni sokucabanga ngakho.

Layisha isiza somphakathi, vula amathuluzi omthuthukisi bese ubheka ukuthi yimaphi ama-cookie uhlelo lokuphequlula eliwaxhuma esicelweni esiya kumsingathi wokuphatha. Uma i-cookie ingenaso isici se-Domain, ingeyomsingathi kuphela futhi ihlala egameni layo; uma ithwala i-Domain=example.com, iya kubo bonke abazalwane, futhi isizinda esingaphansi esisha asikunike lutho kuleyo cookie.

Hlukanisa ukufunda impendulo nokuthumela isicelo

Inqubomgomo yengqikithi efanayo ikhawulela ukufundwa kwezimpendulo phakathi kwezingqikithi. Ayikuvimbeli isicelo ukuthi sithunyelwe, futhi ayivimbeli ifomu ukuthi lithwale ubufakazi uhlelo lokuphequlula esinalo kakade. Isicelo esilula, esinohlobo lwokuqukethwe kwefomu noma i-GET evamile, silethwa ngaphandle kokuhlolwa kwangaphambili; bese i-CORS inquma ukuthi iskripthi esibizayo singayifunda yini impendulo. I-CSRF ihlala ngokuphelele ohlangothini lokuthumela.

Yingakho iseva idinga ukuhlolwa okucacile kwemisebenzi eshintsha isimo. Ithokheni yokuvumelanisa eboshwe kuseshini, noma i-cookie yokuthumela kabili eqhathaniswa kuseva, ihlanganisa leso simo; ukuqhathanisa i-Origin noma i-Referer kufanele kwengezwe njengesango lesibili kodwa hhayi ukuphela, ngoba akusona sonke isicelo esithwala leso sihloko futhi akusona sonke isiphakeli esigcina sona. Umhlahlandlela we-OWASP wokuvimbela i-CSRF uthatha i-SameSite njengengqimba eyodwa phakathi kweziningi, ngenxa yalesi sizathu.

Nquma ukuthi isango lenethiwekhi lifakazela ini ngempela

Uhlu lwezimvume zokuphuma kwe-VPN phambi komsingathi wokuphatha luwukulawula okuhle kanye nesimangalo sobunikazi esibuthakathaka. Lifakazela ukuthi isicelo savela ekhelini elinikezwa yi-VPN, elingase lwabelwana ngabo bonke kulokho kuphuma, futhi alisho lutho ngokuthi ngumuphi umuntu noma idivaysi engemuva kwakho. Kuphatha njengesihlungi sokungena, hhayi njengokuqinisekisa ubunikazi.

Kugcine kungaxhomekekile ekuhloleni kwezinga lesicelo. Uma uhlu luyinto kuphela phakathi komhlaseli nendawo yokugcina eshintsha isimo, umzila owodwa ongalungiswanga kahle, iklayenti elilodwa le-split-tunnel noma ilaptop eyodwa ebolekiwe kususa ukulawula ngokuphelele.

Rekhoda futhi ukwenqatshwa okuvela ngaphandle kwezikhathi ezilindelekile. Ukuqhuma kwazo kuwuphawu olusizo kakhulu lokuthi othile uhlola umngcele osanda kuwakha, futhi ukuthula kuwuphawu lokuthi isihlungi asifinyelelwa nhlobo.

Gcina ama-cookie, ukungena nemvume kucacile

Ububanzi be-cookie bunquma iningi lomphumela. I-cookie yesizinda esingumzali ithunyelwa kumsingathi wokuphatha, ngakho ukufakwa kweskripthi esizeni somphakathi kungasebenza ngeseshini yomqondisi; i-cookie yomsingathi kuphela ayikwazi. Khetha isimo somsngathi kuphela, engeza isici se-Secure futhi usebenzise isiqalo se-__Host- lapho inkundla isekela khona, ngoba leso siqalo sidinga i-Secure, i-Path=/ futhi kungabikho sici se-Domain. Funda isihloko sempendulo hhayi imbiza yama-cookie: Set-Cookie: __Host-admin_session=...; Secure; Path=/; HttpOnly; SameSite=Lax, ngaphandle kwesici se-Domain. Uhlelo lokuphequlula lulahla i-cookie ye-__Host- ethwala i-Domain, ngakho i-cookie esabonakala kumasingathi angabazalwane iwubufakazi bokuthi isiqalo asikaze sisetshenziswe.

Bese ugcina imvume kuseva, kusona sonke isicelo, kuyo yonke indawo yokugcina yokuphatha, hhayi nje ngesikhathi sokungena. Isicelo esivela kunethiwekhi evunyelwe kusafanele siqinisekiswe futhi sivunyelwe emsebenzini oyicelayo; igama lomsingathi akulona isenzo. Uma izinhlelo zomphakathi nezokuphatha zabelana ngokugeleza kokungena noma isitolo sameshini, bhala lobo buxhumano, ngoba yiyo indlela emfushane kunazo zonke esuka ephutheni esizeni somphakathi iya esenzweni sokuphatha.

Hlola umngcele futhi ngemuva kokwehlukanisa

Gijima izivivinyo ezingalungile, hhayi indlela ejabulayo kuphela: ifomu eliwela isiza elingenalo ithokheni kufanele lenqatshwe, ithokheni elivela kwesinye iseshini kufanele lenqatshwe, futhi akukho i-GET okufanele kushintshe isimo. Hlola izici zama-cookie kumathuluzi omthuthukisi, qinisekisa ukuthi ukuhlolwa kwe-Origin kuyavuleka esicelweni esingafani, futhi uzame umsingathi wokuphatha ngaphandle kobubanzi be-VPN ukuze ubone isihlungi sisebenza.

Akukho kulokhu okususa iphutha le-XSS ngaphakathi kohlelo lokuphatha ngokwalo. Igama lomsingathi elihlukile liwumngcele wokwehlukanisa ohlangothini lwesiphequluli onenani langempela, futhi akulona isikhundla sokuvimbela ukusetshenziswa kwekhodi engaphephile noma ukuvikela izicelo ohlangothini lweva. Ngemuva kokwehlukanisa uhlu lufushane kunokuba lubonakala: ingqikithi ehlukile, ama-cookie omsingathi kuphela, ithokheni kukho konke ukushintsha, isihlungi sokungena ongasithembi njengobunikazi, nemvume enqunywa isicelo ngasinye.