CSRF iku apa lan carane nyegah?

Question

Accepted Answer

**CSRF (Cross-Site Request Forgery)** ngapusi browser pengguna sing wis login supaya nggawe **request sing ora diinginke** menyang situs sing mana pengguna kasebut wis autentikasi — nindakake aksi (transfer, owahan) tanpa persetujuan, ngeksploitasi cara browser ngirim kredensial/cookie secara otomatis. ## Carane CSRF bisa kerja ```text The attack exploits that browsers AUTO-SEND cookies (incl. session cookies) with requests: 1. a user is LOGGED IN to a site (has a session cookie) 2. the user visits a MALICIOUS page (or clicks a crafted link) 3. that page makes a request to the target site (e.g. a hidden form auto-submitting) 4. the browser AUTOMATICALLY includes the user's session cookie → the site thinks it's a legitimate request from the user → performs the action (transfer money, change email) → the user unknowingly performs an action they didn't intend. ``` ```html ``` ## Pencegahan ```text ✓ CSRF TOKENS → a unique, unpredictable token per session/form that the server verifies; the attacker's site can't know it → the forged request fails (the primary defense) ✓ SameSite COOKIES → SameSite=Lax/Strict → cookies NOT sent on cross-site requests → blocks CSRF (now a strong, default-ish browser defense) ✓ Check Origin/Referer headers; require re-authentication for sensitive actions ✓ Don't use GET for state-changing actions (use POST/PUT/DELETE properly) → Frameworks often provide CSRF protection built in — enable/use it. ``` ## Pentinge Iki Paham CSRF lan carane nyegah iku berharga amarga iku **kerentanan web sing umum** sing ngeksploitasi cara browser bisa kerja, ngidini penyerang nindakake aksi minangka pengguna sing wis autentikasi, mula penting tenan pengetahuan keamanan untuk pengembang web. Paham **carane CSRF bisa kerja** — ngeksploitasi yen browser **ngirim cookie secara otomatis** (kalebu cookie sesi) karo request, mula halaman jahat bisa ngluncurke request menyang situs sing mana pengguna wis login, lan browser ngirim cookie sesi, bikin situs nganggep request palsu kasebut sah lan nindakake aksi (transfer, owahan akun) tanpa konsén pengguna — kudu dipahami kanggo mangerteni serangan sing halus tapi berbahaya iki. CSRF berbahaya amarga bisa nindakake aksi sensitif minangka korban tanpa kasuwaraning dheweke, lan iku kerentanan web sing umum. Paham **pencegahan** iku penting: **token CSRF** (token unik, ora bisa ditebak per sesi/formulir sing server verifikasi — situs penyerang ora bisa tahuake, mula request palsu bakal gagal; pertahanan tradisional utama), **cookie SameSite** (setel SameSite=Lax/Strict supaya cookie ora dikirim ing request lintas-situs, saiki pertahanan tingkat browser sing kuwat lan saya dadi default), mriksa header Origin/Referer, mbalekake autentikasi untuk aksi sensitif, lan ora nggunakake GET kanggo operasi owah-owahan status. Paham yen **framework asring nyediake proteksi CSRF sing wis dibangun** (sing kudu diaktifke lan digunakake) iku penting secara praktis. Gabungan token CSRF lan cookie SameSite nyediake proteksi sing kuat. Karena CSRF iku kerentanan web sing umum sing ngeksploitasi tingkah laku browser kanggo nindakake aksi ora diinginke minangka pengguna sing wis autentikasi, lan amarga paham carane iku bisa kerja lan carane nyegahake (token CSRF, cookie SameSite, proteksi framework) iku penting kanggo pengembang web, paham CSRF lan cara nyegahake iku berharga, pengetahuan keamanan sing relevan secara praktis — kerentanan web penting kanggo dipahami lan dibela, sing pertahanan-pertahanane (token CSRF lan cookie SameSite) iku pengetahuan kunci kanggo nglindungi pengguna supaya ora dapeted apuse nindakake aksi ora diinginke, kelas serangan penting kanggo aplikasi web apa wae sing duwe operasi owah-owahan state sing perlu autentikasi.