SV.CSRF.TOKEN

This error identifies state changing request handlers that do not validate incoming requests against a stored CSRF token.

Vulnerability and risk

Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user’s web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.

A standard approach to mitigating CSRF vulnerabilities is to use synchronizer tokens. A cryptographically secure random token is uniquely associated with a user session and added as a hidden field to any form that results in a state changing operation. The server rejects the requested action if the CSRF token fails validation.

Code examples

Vulnerable code example 1

Copy

6
7
8
9
10
11
12
13
14
15
16
17
18
    void doPost(HttpServletRequest req, HttpServletResponse resp) {
        String action = req.getParameter("action");
        String id = req.getParameter("id");
    
       if("update".equals(action)){
           updateUser(id, req);
       }
       //...
   }

   void updateUser(String userid, HttpServletRequest req) {
       //...
   }

SV.CSRF.TOKEN is reported on line 6: ‘req’ is never checked against a possible cross-site request forgery attack. The handler should verify that the request contains a valid CSRF token before changing the state of the application.

Fixed code example 1

Copy

6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
    void doPost(HttpServletRequest req, HttpServletResponse resp) {
        if
    (req.getParameter("_csrf_token").equals(req.getSession().getAttribute("_csrf_token"))) {
            String action = req.getParameter("action");
           String id = req.getParameter("id");
 
           if ("update".equals(action)) {
               updateUser(id, req);
           }
           //...
       }
   }

   void updateUser(String id, HttpServletRequest req) {
       //...
   }

The updated code validates the request before modifying the application state. If the token submitted with the request doesn’t match the token stored in the user’s session, the request is denied.

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Cross Site Request Forgery Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.