METHOD FOR PROVIDING WEB APPLICATION SECURITY
A method for an HTTP server to decide whether a remote client is victim of a phishing ttack, comprising: —receiving a first HTTP request from the remote client on said HTTP Server; —responding to said first HTTP request, wherein a token is added to the response submitted to said remote client; —receiving a second HTTP request on said HTTP server; —judging whether the second HTTP request includes said token; —judging whether the token originates from said remote client; —processing the HTTP request when said remote client has really issued the second HTTP request.
1 . A method for an HTTP server to decide whether a remote client is victim of a phishing attack, comprising:
receiving a first HTTP request from the remote client on said HTTP Server;
responding to said first HTTP request, wherein a token is added to the response submitted to said remote client;
receiving a second HTTP request on said HTTP server;
judging whether the second HTTP request includes said token;
judging whether the token originates from said remote client;
processing the HTTP request when said remote client has really issued the second HTTP request.
2 . The method according to claim 1 , wherein said token is a digital signature.
3 . The method according to claim 2 , wherein said digital signature is a cryptographic hash.
4 . The method according to claim 3 , wherein said token is added to a referrer of said first HTTP request and it is judged, whether said HTTP request includes the referrer.
5 . The method according to claim 4 , wherein a HTML warning page is returned, if said token does not match the client.
6 . The method according to claim 1 , further comprising: allowing the real emitter of an HTTP requests to access a resource.
7 . The method according to claim 6 , wherein a HTTP Server access control is maintained by programming the client browser to store a token or a similar tag for use in later HTTP requests on the same server.
8 . Device for deciding whether a remote client is victim of a phishing attack, comprising a Web server and a module for implementing on said HTTP server and for carrying out the method according to claim 1 .
9 . A computer program comprising computer program code means for performing the method of claim 1 when said program is run on a computer.
10 . A computer program as claimed in claim 10 embodied on a computer readable medium.
11 . A method for an HTTP server to decide whether a remote client is victim of a phishing attack according to claim 1 , substantially as described herein with reference to the accompanying drawings.
12 . Device for deciding whether a remote client is victim of a phishing attack according to claim 8 , substantially as described herein with reference to the accompanying drawings.
13 . The method according to claim 1 , wherein said token is added to a referrer of said first HTTP request and it is judged, whether said HTTP request includes the referrer.
14 . The method according to claim 13 , wherein a HTML warning page is returned, if said token does not match the client.
15 . The method according to claim 1 , wherein a HTML warning page is returned, if said token does not match the client.
16 . The method according to claim 1 , wherein a HTTP Server access control is maintained by programming the client browser to store a token or a similar tag for use in later HTTP requests on the same server.