Cross site request forgery (CSRF) protection for web browsers

1. An application program interface (API) management architecture comprising an API gateway, the API gateway comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving an authentication request;

generating a cross site request forgery (CSRF) token;

generating a session based on the authentication request;

generating a cookie comprising session properties associated with the session, the cookie further comprising an attribute flag with a value indicating whether or not the cookie needs to be received along with the CSRF token in an operation request;

transmitting an authentication response comprising the cookie and the CSRF token;

receiving the operation request to perform a first operation;

determining whether or not the CSRF token and the attribute flag are received along with the operation request; and

performing the first operation based on the CSRF token and the attribute flag received along with the operation request, or a second operation based on the CSRF token not being received along with the operation request.

2. The API gateway of claim 1 , wherein determining whether or not the attribute flag is received along with the operation request further comprises determining the attribute flag is present in a header of the operation request, further comprising:

performing the first operation based on the value of the attribute flag, and on the CSRF token being present in the operation request.

3. The API gateway of claim 1 , further comprising:

determining the CSRF token is not present in the operation request; and

performing the second operation based on a boolean value being utilized to set the value of the attribute flag, and on the CSRF token not being present in the operation request.

4. The API gateway of claim 1 , wherein:

the cookie is implemented as a JavaScript Object Notation (JSON) Web Token (JWT) token; and

the operation request is required to be accompanied by the CSRF token based on the attribute flag, for the API gateway to allow one or more services associated with the operation request.

5. The API gateway of claim 1 , wherein:

the authentication request is received based on a user of a client device selecting an authentic link; and

the CSRF token is a first CSRF token, further comprising:

performing the second operation based on determining a second operation request is received from the client device, based on the user of the client device selecting a malicious link, the second operation request determined to be received from a malicious client based on:

the second operation comprising no CSRF token; or

the second operation comprising a second CSRF token that does not match the first CSRF token.

6. The API gateway of claim 1 , wherein

the authentication request is received based on a user of a client device selecting an authentic link, further comprising:

performing the second operation based on determining the operation request is received from the client device, based on the user of the client device selecting a malicious link, the second operation comprising not transmitting an operation response to the client device.

7. The API gateway of claim 1 , wherein:

the authentication request is received based on a user of a client device selecting an authentic link, further comprising:

performing the first operation based on determining the operation request is received from the client device, the first operation comprising transmitting an operation response to the client device.

8. The API gateway of claim 1 , wherein:

a non-random value is utilized to set the value of the attribute flag, and

the attribute flag is different from the CSRF token, and from data that is used to create the CSRF token.

9. A method, for an application program interface (API) gateway, the method comprising:

receiving a cookie comprising session properties associated with a client device, the cookie further comprising an attribute flag with a value indicating whether or not a cross site request forgery (CSRF) token needs to accompany the cookie in an operation request, the CSRF token being associated with an internal secret utilized to generate a session to provide services for the client device;

transmitting the cookie and the CSRF token;

receiving the operation request to perform a first operation;

determining whether or not the CSRF token is received along with the operation request, based at least in part on the attribute flag; and

performing the first operation based at least in part on the CSRF token being received along with the operation request, or a second operation based at least in part on the CSRF token not being received along with the operation request.

10. The method of claim 9 , further comprising:

receiving a session request,

wherein:

the session is generated based at least in part on the session request;

the session is hashed with the internal secret utilized to generate a secret value as the CSRF token; and

a requirement for the secret value is indicated by an indicator, the indicator being generated as the attribute flag.

11. The method of claim 10 , wherein a secret value is generated as the CSRF token.

12. The method of claim 9 , wherein the cookie further comprises session properties associated with the session.

13. The method of claim 9 , further comprising:

performing the first operation based at least in part on a non-random value being utilized to set the value of the attribute flag, the non-random value indicating a requirement of a secret value that is generated as the CSRF token accompanying the operation request.

14. The method of claim 9 , further comprising:

performing the first operation based at least in part on the attribute flag determined to be present in a header of the operation request, and further based at least in part on a secret value that is generated as the CSRF token accompanying the operation request.

15. The method of claim 9 , further comprising:

performing the second operation is based at least in part on the attribute flag, and on a secret value that is generated as the CSRF token not accompanying the operation request.

16. A mobile device executing a web browser, the mobile device comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

transmitting a first request with an attribute flag, the attribute flag comprising a value indicating whether or not a cross site request forgery (CSRF) token needs to accompany a cookie in an operation request, the CSRF token being associated with an internal secret utilized to generate a session to provide services for the mobile device;

receiving a response, the response comprising the cookie and the CSRF token, the cookie comprising the attribute flag and session properties associated with session; and

transmitting the operation request, the operation request comprising the cookie with the attribute flag, the operation being performed based at least in part on the attribute flag and the CSRF token being transmitted along with the operation request.

17. The web browser of claim 16 , wherein:

the first request is a session request; and

a non-random value flag is utilized to generate the cookie and to set the value of the attribute flag being inserted in a header of the session request.

18. The web browser of claim 16 , wherein:

the session is generated based at least in part on the first request;

the session is hashed with an internal secret utilized to generate a secret value as the CSRF token; and

a requirement for the secret value is indicated by the attribute flag.

19. The web browser of claim 16 , wherein:

a secret value is generated as the CSRF token; and

the cookie further comprises session properties associated with the session.

20. The web browser of claim 16 , wherein the response is a first response received from an application program interface (API) gateway, further comprising:

receiving a second response from the API gateway, the second response comprising data indicating that a third request received by the API gateway was declined based at least in part on the third request being received without any CSRF token.