Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 4 subscribers
  • Views 979 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF und Schutz vor CSRF

RemoHehlert

Hallo zusammen,

gibt es Einstellungen die vorgenommen werden müssen um durch Sophos mit Reversproxy Authentifizierung bereitsgestellte Webseiten vor CSRF Angriffe zu schützen?

Wie müssten WAF Loginseiten aussehen um sie entsprechend vor CSRF zu schützen?

Besten Dank im Voraus

MFG TBC



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Jaydeep

    Hello, Jaydeep,


    I saw the settings under Advanced Protection. But I'm not sure if which of these settings actually protect against CSRF.
    Most of our pages for example do not work when form-hardening is active.
    Currently I only have cookie signing and filtering enabled.
    But if this is a sufficient protection I cannot judge "yet".
    As an example, calls currently look like this:

    2020:01:23-08:08:32 fw-1 httpd: id="0299" srcip="xx.xx.xx.xx" localip="yy.yyy.yyy.yy" size="5061" user="user" host="xx.xx.xx.xx" method="GET" statuscode="200" reason="-" extra="-" exceptions="SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken" time="581734" url="/front/central.php" server="seite.db.de:8082" port="8082" query="" referer="seite.de:8082/_uwxctlguznw_form cookie="glpi_3f946f74140a3178722cb675d5bf6b47=4spejqjdn1sk8fdhm3t29guva3" set-cookie="uwxctlguznw_cookie=0bf38aeb60b11935621103bf93d99c94ceaf07c9;path=/;httponly;secure, HASH_uwxctlguznw_cookie=5605344D152358BE9346F0B52FD4B7C6A9E49268; path=/; httponly; secure" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XilGb956OVqBHw7JHhkgFQAAAJA"
    20


    I've seen entries with "CSRF token verification" in other posts but they are completely missing in my pages.
    The documentation "KB" from Sophos is not quite as understandable from my point of view.

    So if you can provide some more Information to me it would be glad

     

    Many thanks

    TBC

Unfiltered HTML