CSRF , SSRF , XSS 有關網頁安全小記

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

$(function() {
  $("#btn").click(function() {
    $.ajax({
      type: "POST",
      url: "/ajax", //ajax接收的server端
      data:
        $("#form").serialize() +
        "&csrf_test_name=" +
        getCookie("csrf_test_name"),
      success: function(data) {
        alert(data.msg);
      },
      dataType: "json"
    });
  });
});

function getCookie(name) {
  var arr = document.cookie.match(new RegExp("(^| )" + name + "=([^;]*)(;|$)"));
  if (arr != null) return unescape(arr[2]);
  return null;
}

1
2
3

$.ajaxSetup({
  headers: { "X-CSRF-TOKEN": "{{ csrf_token() }}" }
});

1

<meta name="_token" content="{{ csrf_token() }}" />

1
2
3
4
5

$.ajaxSetup({
   headers: {
       'X-CSRF-TOKEN': $('meta[name="_token"]').attr('content')
   }
});

1
2
3
4
5

$.ajaxSetup({
  headers: {
    "X-XSRF-TOKEN": $.cookie("XSRF-TOKEN")
  }
});

1
2
3
4

 // `xsrfCookieName` is the name of the cookie to use as a value for xsrf token
xsrfCookieName: 'XSRF-TOKEN', // default
// `xsrfHeaderName` is the name of the http header that carries the xsrf token value
xsrfHeaderName: 'X-XSRF-TOKEN', // default