How secure is HTTP_ORIGIN?

by

HTTP_ORIGIN is a way to protect against CSRF (Cross Site Request Forgery) requests. Currently it is implemented only by Chrome (as of Nov 2011). I tested Firefox and Opera, but they failed.

Its name in the request header is Origin. On the server in my PHP script I see it as HTTP_ORIGIN in the $_SERVER array. This header is sent only in some cases, when protection against CSRF is required (only POST should be sufficient). Here is list of all requests whether it is set or not:

https://wiki.mozilla.org/Security/Origin

  • Anchor tag – NO
  • Window navigation – NO
  • IMG – NO
  • iframe, embed, applet – YES
  • Form (GET and POST) – YES
  • SCRIPT – YES
  • stylesheets – NO
  • dependent loads from stylesheets – NO
  • Redirects – YES
  • XHR – YES

The Origin header is implemented only in Chrome, unfortunately. It was announced first in January 2010 on Google Chrome’s blog:

http://blog.chromium.org/2010/01/security-in-depth-new-security-features.html

CSRF Protection via Origin Header

The Origin header is a new HTML5 feature that helps you defend your site against cross-site request forgery (CSRF) attacks. In a CSRF attack, a malicious web site, say attacker.com, instructs the user’s browser to send an HTTP request to a target server, say example.com, that confuses the example.com server into performing some action. For example, if example.com is a webmail provider, the CSRF attack might trick example.com into forwarding an email message to the attacker.

The Origin header helps sites defend against CSRF attacks by identifying which web site generated the request. In the above example, example.com can see that the request came from the malicious web site because the Origin header contains the value http://attacker.com. To use the Origin header as a CSRF defense, a site should modify state only in response to requests that either (1) lack an Origin header or (2) have an Origin header with a white-listed value.

I am just implementing CSRF protection in my PHP script, I personally use Chrome, so that is sufficient for me, I hope other browsers will catch up with Chrome soon.

What is funny is that Mozilla invented that security feature, as you can read lots of documentation of that Origin header on its website, but they still didn’t have time to implement it 😉

HTTP_ORIGIN seems to contain only protocol and domain, without slash at the end:
“http://www.example.com” – even if you submit the form from “http://www.example.com/myform/”.

A simple protection against CSRF in PHP script:

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    if (isset($_SERVER['HTTP_ORIGIN'])) {
        $address="http://".$_SERVER['SERVER_NAME'];
        if (strpos($address, $_SERVER['HTTP_ORIGIN']) !== 0) {
            exit('CSRF protection in POST request: detected invalid Origin header: '.$_SERVER['HTTP_ORIGIN']);
        }
    }
}

This script could still be upgraded to support PORT other than 80 (Origin contains the port when it’s different than 80), HTTPS connections, and submitting the forms from different subdomains (ex. sub.example.com => posting request to www.example.com).

More Related Contents:

  1. Create subdomains on the fly with .htaccess (PHP)
  2. PHP Getting Domain Name From Subdomain
  3. can’t send email to addresses at my own domain
  4. How To Detect An Incoming Request (With PHP Script) From a CNAME Subdomain?
  5. Number in the top-level domain?
  6. want to convert a string into array [duplicate]
  7. Laravel combined OR AND Solution
  8. Select those record only from table 1 where city exist against state id in table 2 in PHP
  9. How to remove duplicate values from a multi-dimensional array in PHP
  10. create array tree from array list
  11. How do I iterate over the results in a MySQLi result set?
  12. What is the point of interfaces in PHP?
  13. How to fake $_SERVER[‘REMOTE_ADDR’] variable?
  14. Why is this PHP call to json_encode silently failing – inability to handle single quotes?
  15. Destroy PHP Session on closing
  16. new limit within php: 1000 fields per POST. Does someone know, if the number can be influenced?
  17. Setup HTTP expires headers using PHP and Apache
  18. Dynamic Paypal button encryption
  19. Best methods to clean up a hacked site with no clean version available?
  20. How can I access a deep object property named as a variable (dot notation) in php?
  21. Notice: Unknown: Skipping numeric key 1 in Unknown on line 0
  22. how to re-format datetime string in php?
  23. Download CSV file using “AJAX”
  24. executing a Powershell script from php
  25. Get all Orders IDs from a product ID in Woocommerce
  26. How to prevent PDO from interpreting a question mark as a placeholder?
  27. Passing null to non-nullable internal function parameters – Updating Existing Code Base to php 8.1
  28. Can I trust PHP __destruct() method to be called?
  29. php – add two hours to date variable
  30. phpmysql error – #1273 – #1273 – Unknown collation: ‘utf8mb4_general_ci’

Leave a Comment