Mini Program Protection prevents Cross-Site Request Forgery (CSRF) through several mechanisms, primarily by leveraging the secure architecture of mini programs and additional security layers. Here's how it works:
Token-Based Validation: Mini programs often use unique tokens (e.g., session tokens or CSRF tokens) to verify the authenticity of requests. These tokens are generated by the server and embedded in the mini program. When a request is made, the server validates the token to ensure it matches the expected value, preventing unauthorized requests from malicious sites.
Isolated Execution Environment: Mini programs run in a sandboxed environment, separate from the browser, which reduces the risk of CSRF attacks that exploit browser vulnerabilities. This isolation prevents malicious websites from directly accessing or manipulating the mini program's data or requests.
Request Signing: Some mini programs use request signing, where each request is signed with a secret key known only to the mini program and the server. This ensures that even if a malicious site intercepts the request, it cannot forge a valid signature to execute unauthorized actions.
Referrer and Origin Checks: The server can validate the Referer or Origin headers of incoming requests to ensure they originate from trusted sources (e.g., the mini program itself). If the headers are missing or mismatched, the request is rejected.
Example:
A banking mini program allows users to transfer funds. To prevent CSRF, the server generates a unique CSRF token for each session and includes it in the mini program's UI. When the user initiates a transfer, the mini program includes this token in the request. The server verifies the token before processing the transaction. If an attacker tries to trick the user into submitting a forged request from another site, the token will be missing or invalid, and the server will reject the request.
For enhanced security, Tencent Cloud offers Mini Program Security Protection, which includes CSRF mitigation features, such as token management, request validation, and real-time threat detection, to safeguard mini programs from malicious attacks.