System and method for cross-site reference forgery attack prevention using double validated tokens with time sensitivity

1. A method for validating a form comprising:

providing, to a client device, the form comprising a primary token, wherein the primary token comprises plaintext and a first plaintext hash;

receiving, by a hardware processor and in response to the client loading the form, a request for a secondary token;

providing, by the hardware processor, the secondary token in response to receiving the request;

receiving the form comprising the primary token and the secondary token from a client;

validating the form, wherein validating the form comprises:

obtaining a first primary token hash from the secondary token,

applying a first hash function to the primary token to obtain a second primary token hash,

determining that the first primary token hash and the second primary token hash match;

applying a second hash function to the plaintext to obtain a second plaintext hash, and

determining that the first plaintext hash and the second plaintext hash match; and

accepting the form upon validating the form.

2. The method of claim 1 , wherein the plaintext comprises unencrypted data associated with a user of the client.

3. The method of claim 1 , wherein the primary token comprises first plaintext, and wherein validating the form further comprises:

obtaining user data elements from a user identity; and

determining that the user data elements and the first plaintext match.

4. The method of claim 3 , wherein the secondary token comprises second plaintext, and wherein the first plaintext is different from the second plaintext.

5. The method of claim 1 , wherein the primary token comprises an expiration time, and wherein validating the form further comprises:

determining that the current time is before the expiration time.

6. The method of claim 1 , wherein the primary token comprises a series number, and wherein validating the form further comprises:

obtaining a token series counter value from a user identity; and

determining that the series number matches the token series counter value.

7. The method of claim 1 , wherein determining that the form is valid further comprises:

obtaining a first secondary token hash from the primary token;

applying the first hash function to the secondary token to obtain a second secondary token hash; and

determining that the first secondary token hash and the second secondary token hash match.

8. The method of claim 1 , wherein the first hash function is applied to a portion of the primary token.

9. A system comprising:

a computer processor and memory; and

a server program stored in the memory and executing on the computer processor with functionality to:

provide, to a client a form comprising a primary token, wherein the primary token comprises plaintext and a first plaintext hash;

receive, in response to the client loading the form, a request for a secondary token;

provide the secondary token in response to receiving the request;

receive the form comprising the primary token and the secondary token from a client;

validate the form, wherein the form is validated by:

obtaining a first primary token hash from the secondary token;

applying a first hash function to the primary token to obtain a second primary token hash;

determining that the first hash function and the second hash function match;

applying a second hash function to the plaintext to obtain a second plaintext hash; and

determining that the first plaintext hash and the second plaintext hash match; and

accept the form upon determining the form is validated.

10. The system of claim 9 , further comprising:

a user identity comprising:

a token series counter value,

wherein the server program comprises further functionality to:

obtain the token series counter value from the user identity; and

determine that the series number matches the token series counter value.

11. The system of claim 9 , wherein the plaintext comprises unencrypted data associated with a user of the client.

12. The system of claim 9 , wherein the primary token comprises first plaintext, and wherein the server program comprises further functionality to:

obtain user data elements from the user identity; and

determine that the user data elements and the first plaintext match.

13. The system of claim 12 , wherein the secondary token comprises second plaintext, and wherein the first plaintext is different from the second plaintext.

14. The system of claim 9 , wherein the primary token comprises an expiration time, and wherein the server program comprises further functionality to:

determine that the current time is before the expiration time.

15. The system of claim 9 , wherein the server program comprises further functionality to:

obtain a first secondary token hash from the primary token;

apply the first hash function to the secondary token to obtain a second secondary token hash; and

determine that the first secondary token hash and the second secondary token hash match.

16. The system of claim 9 , wherein the first hash function is applied to a portion of the primary token.

17. A computer readable storage medium comprising instructions that, when executed by a processor, comprise functionality to perform the steps of:

providing, to a client a form comprising a primary token, wherein the primary token comprises plaintext and a first plaintext hash;

receiving, in response to the client loading the form, a request for a secondary token;

providing the secondary token in response to receiving the request;

receiving the form comprising the primary token and the secondary token from a client;

validating the form, wherein validating the form comprises:

obtaining a first primary token hash from the secondary token;

applying a first hash function to the primary token to obtain a second primary token hash;

determining that the first primary token hash and the second primary token hash match;

applying a second hash function to the plaintext to obtain a second plaintext hash; and

determining that the first plaintext hash and the second plaintext hash match; and

accepting the form upon validating the form.

18. The computer readable memory of claim 17 , wherein the primary token comprises a series number, and wherein validating the form further comprises:

obtaining a token series counter value from a user identity; and

determining that the series number matches the token series counter value.