Protecting against Cross-Site Request Forgery (CSRF) is something that we tend to see everywhere now. What we usually see is a solution with a token in the form pdp described this a couple of months ago here: Preventing CSRF. Now, the problem is when you don't have dynamic pages, when you are stuck with static HTML pages but you can use JavaScript! Of course, the first reflex when you want to prevent CSRF is to use only POST variable when you send data, this make the attack a little harder.

I started thinking of this because I had this problem: I had static pages that are using Ajax to send data using POST. I talked with Stefano Di Paola about this (because my problem was not only CSRF, but also parameter tampering...). We both conclude on the following Ajax based solution:

  • XMLHTTPRequest a remote script which set a token into the HTTP header
  • Use JavaScript to get this token
  • Make your basic XMLHTTPRequest with the following token


So you need 3 files:

  • getheaders.php: Set the token into the header
  • ajax.js: Make the call and use the token technique
  • result.php: The classical target script

You can find the demo here: anti-csrf/index.html