Providing cross site request forgery protection at an edge server
An edge server receives a request from a client device to access a resource. The edge server determines whether the requested resource includes a tag within the code of the resource. When the edge server determines there is the tag in the resource, the edge server generates a token, associates the token with the resource (e.g., inserts the token in the code of the resource), and sends the resource to the requesting client device. In response to subsequent requests from the client device for actions to be performed with respect to the resource, the edge server determines whether the action requires a token. When the requested action requires the token, the edge server extracts the token in the request and processes the request after validating the token.
1. A method, comprising:
determining, by an edge server, a resource includes a token tag indicating a location for token placement in the resource;
generating a first token value;
inserting the first token value at the location for token placement in the resource;
sending the resource including the first token value to a client device in response to a first request for the resource;
receiving, by the edge server, a second request from the client device for an action to be performed on the resource;
determining that the action to be performed on the resource is of a type requiring a token by:
accessing a profile associated with the resource, the profile including one or more of a list of endpoints and a set of methods requiring the token, and
determining that the action to be performed is to access an endpoint in the list of endpoints or to perform a method in the set of methods stored in the profile;
determining that the second request includes a valid second token value; and
sending the second request to an origin server hosting the resource in response to determining that the second request includes the valid second token value.
2. The method of claim 1 , further comprising:
retrieving the resource from the origin server; and
caching the resource including the token tag in a cache associated with the edge server prior to generating the first token value.
3. The method of claim 1 , wherein determining that the second request includes the valid second token value comprises:
extracting a second token value from the second request; and
comparing the extracted second token value to the first token value generated by the edge server, wherein the second token value is valid when the second token value matches the first token value.
4. The method of claim 1 , wherein the second request for the action to be performed is a state-changing request for the resource.
5. The method of claim 1 , wherein the resource comprises HTML code and the token tag is included in the HTML code to indicate the location for token placement in the HTML code.
6. The method of claim 1 , wherein the first token value is generated based on user identifying information and zone information retrieved in the first request for the resource.
7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:
determining, by an edge server, a resource includes a token tag indicating a location for token placement in the resource;
generating a first token value;
inserting the first token value at the location for token placement in the resource;
sending the resource including the first token value to a client device in response to a first request for the resource;
receiving, by the edge server, a second request from the client device for an action to be performed on the resource;
determining that the action to be performed on the resource is of a type requiring a token by:
accessing a profile associated with the resource, the profile including one or more of a list of endpoints and a set of methods requiring the token, and
determining that the action to be performed is to access an endpoint in the list of endpoints or to perform a method in the set of methods stored in the profile;
determining that the second request includes a valid second token value; and
sending the second request to an origin server hosting the resource in response to determining that the second request includes the valid second token value.
8. The non-transitory machine-readable storage medium of claim 7 that provides instructions that, when executed by the processor, cause the processor to further perform operations comprising:
retrieving the resource from the origin server; and
caching the resource including the token tag in a cache associated with the edge server prior to generating the first token value.
9. The non-transitory machine-readable storage medium of claim 7 , wherein determining that the second request includes the valid second token value comprises:
extracting a second token value from the second request; and
comparing the extracted second token value to the first token value generated by the edge server, wherein the second token value is valid when the second token value matches the first token value.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the second request for the action to be performed is a state-changing request for the resource.
11. The non-transitory machine-readable storage medium of claim 7 , wherein the resource comprises HTML code and the token tag is included in the HTML code to indicate the location for token placement in the HTML code.
12. The non-transitory machine-readable storage medium of claim 7 , wherein the first token value is generated based on user identifying information and zone information retrieved in the first request for the resource.
13. An apparatus, comprising:
a processor;
a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, cause said processor to perform the following:
determine a resource includes a token tag indicating a location for token placement in the resource;
generate a first token value;
insert the first token value at the location for token placement in the resource;
send the resource including the first token value to a client device in response to a first request for the resource;
receive a second request from the client device for an action to be performed on the resource;
determine that the action to be performed on the resource is of a type requiring a token by:
accessing a profile associated with the resource, the profile including one or more of a list of endpoints and a set of methods requiring the token, and
determining that the action to be performed is to access an endpoint in the list of endpoints or to perform a method in the set of methods stored in the profile;
determine that the second request includes a valid second token value; and
send the second request to an origin server hosting the resource in response to determining that the second request includes the valid second token value.
14. The apparatus of claim 13 , wherein the instructions further cause said processor to perform the following:
retrieve the resource from the origin server; and
cache the resource including the token tag in a cache prior to generating the first token value.
15. The apparatus of claim 13 , wherein determining that the second request includes the valid second token value comprises:
extracting a second token value from the second request; and
comparing the extracted second token value to the first token value, wherein the second token value is valid when the second token value matches the first token value.
16. The apparatus of claim 13 , wherein the second request for the action to be performed is a state-changing request for the resource.
17. The apparatus of claim 13 , wherein the resource comprises HTML code and the token tag is included in the body of the HTML code to indicate the location for token placement in the HTML code.
18. The apparatus of claim 13 , wherein the first token value is generated based on user identifying information and zone information retrieved in the first request for the resource.