CSRF Tokens vs Brute Force Attacks

TL;DR

Anti-CSRF tokens do not directly prevent brute force attacks on login forms (or other sensitive areas). They protect against attackers exploiting a logged-in user’s session, but they don’t stop someone repeatedly guessing passwords. You need separate measures like rate limiting and account lockout to combat brute force.

What is a CSRF Token?

A Cross-Site Request Forgery (CSRF) token is a unique, secret value included in forms that your website sends. It’s designed to make sure the request actually came from your site and not a malicious one.

What is a Brute Force Attack?

A brute force attack involves an attacker trying many different usernames and passwords until they find the correct combination. This doesn’t rely on exploiting a user’s existing session; it tries to create a new one by guessing credentials.

Why CSRF Tokens Don’t Stop Brute Force

1. Different Attack Vectors: CSRF exploits an existing authenticated session. A brute force attack attempts to establish a session.
2. Token Validation Happens After Login: The CSRF token is checked when submitting a form *after* the user has logged in (or is attempting to perform an action requiring authentication). Brute force attacks happen *before* login, on the login form itself.
3. No Session Required: A brute force attack doesn’t need a valid session cookie; it sends credentials directly with each attempt.

How to Prevent Brute Force Attacks

Here are some effective strategies:

1. Rate Limiting: Limit the number of login attempts from a single IP address or user account within a specific timeframe. For example, allow only 5 failed login attempts per minute.

   # Example using fail2ban (Linux) - adjust to your system
   banip 10m 5 maxretry=5

2. Account Lockout: Temporarily lock an account after a certain number of failed login attempts. This prevents attackers from continuously guessing.

   Example (conceptual): After 3 incorrect passwords, lock the account for 15 minutes.

3. Strong Password Policies: Enforce strong password requirements (length, complexity, etc.).
4. Two-Factor Authentication (2FA): Add an extra layer of security beyond just a username and password.
5. CAPTCHAs: Use CAPTCHAs to distinguish between human users and bots.

   Be aware that CAPTCHAs can have usability issues.

6. Monitor Login Attempts: Log failed login attempts and alert administrators if there’s suspicious activity.

CSRF Tokens Still Matter!

Don’t remove CSRF protection just because it doesn’t stop brute force attacks. They are crucial for preventing other types of attacks, such as:

• Cross-Site Request Forgery (CSRF): Preventing attackers from making unwanted actions on behalf of a logged-in user.