{"id":9090,"date":"2026-08-24T16:53:25","date_gmt":"2026-08-24T13:53:25","guid":{"rendered":"https:\/\/www.domainhizmetleri.com\/blog\/?p=9090"},"modified":"2026-08-24T16:53:26","modified_gmt":"2026-08-24T13:53:26","slug":"csrf-saldirisi-nedir","status":"publish","type":"post","link":"https:\/\/www.domainhizmetleri.com\/blog\/csrf-saldirisi-nedir\/","title":{"rendered":"CSRF Sald\u0131r\u0131s\u0131 Nedir? CSRF Token Nas\u0131l \u00c7al\u0131\u015f\u0131r?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Web uygulamalar\u0131nda kullan\u0131c\u0131 oturumlar\u0131 genellikle \u00e7erezler arac\u0131l\u0131\u011f\u0131yla y\u00f6netilir. Kullan\u0131c\u0131 bir web sitesinde oturum a\u00e7t\u0131\u011f\u0131nda taray\u0131c\u0131, sonraki isteklerde ilgili oturum \u00e7erezini otomatik olarak sunucuya g\u00f6nderir. Bu \u00e7al\u0131\u015fma bi\u00e7imi kullan\u0131m kolayl\u0131\u011f\u0131 sa\u011flarken gerekli g\u00fcvenlik \u00f6nlemleri al\u0131nmad\u0131\u011f\u0131nda CSRF sald\u0131r\u0131lar\u0131na zemin haz\u0131rlayabilir. Bu rehberde CSRF sald\u0131r\u0131s\u0131 nedir, hangi i\u015flemleri hedef al\u0131r ve CSRF token nas\u0131l \u00e7al\u0131\u015f\u0131r sorular\u0131n\u0131 ele al\u0131yoruz.<\/p>\n\n\n<figure class=\"wp-block-post-featured-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"502\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T224135.779.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"\" style=\"object-fit:cover;\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T224135.779.png 1200w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T224135.779-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T224135.779-1024x428.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Adsiz-tasarim-2026-08-11T224135.779-990x414.png 990w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n<h2 class=\"wp-block-heading\">CSRF Sald\u0131r\u0131s\u0131 Nedir?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF, Cross-Site Request Forgery ifadesinin k\u0131saltmas\u0131d\u0131r. T\u00fcrk\u00e7ede Siteler Aras\u0131 \u0130stek Sahtecili\u011fi olarak adland\u0131r\u0131l\u0131r. Bu sald\u0131r\u0131da oturumu a\u00e7\u0131k olan bir kullan\u0131c\u0131n\u0131n taray\u0131c\u0131s\u0131, bilgisi d\u0131\u015f\u0131nda hedef web uygulamas\u0131na istek g\u00f6ndermek i\u00e7in kullan\u0131l\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sald\u0131rgan do\u011frudan kullan\u0131c\u0131n\u0131n parolas\u0131n\u0131 veya oturum \u00e7erezini ele ge\u00e7irmek zorunda de\u011fildir. Kullan\u0131c\u0131n\u0131n hedef uygulamada daha \u00f6nce kimlik do\u011frulamas\u0131 yapm\u0131\u015f olmas\u0131 yeterli olabilir. Taray\u0131c\u0131 ge\u00e7erli oturum \u00e7erezini iste\u011fe otomatik olarak ekledi\u011fi i\u00e7in sunucu, g\u00f6nderilen talebin kullan\u0131c\u0131 taraf\u0131ndan ba\u015flat\u0131ld\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF sald\u0131r\u0131s\u0131, uygulaman\u0131n iste\u011fin kayna\u011f\u0131n\u0131 ve kullan\u0131c\u0131 niyetini do\u011frulamad\u0131\u011f\u0131 durumlarda ba\u015far\u0131l\u0131 olabilir. Bu nedenle yaln\u0131zca oturum kontrol\u00fc yapmak kritik i\u015flemlerin g\u00fcvenli\u011fi i\u00e7in yeterli de\u011fildir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"428\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-1024x428.png\" alt=\"\" class=\"wp-image-9094\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-1024x428.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-300x125.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-1536x642.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-gerceklesir.png 1939w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">CSRF Sald\u0131r\u0131s\u0131 Nas\u0131l Ger\u00e7ekle\u015fir?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kullan\u0131c\u0131 <code>domainadresiniz.com<\/code> \u00fczerinde oturum a\u00e7t\u0131ktan sonra ba\u015fka bir web sayfas\u0131n\u0131 ziyaret edebilir. Bu sayfada sald\u0131rgan taraf\u0131ndan haz\u0131rlanm\u0131\u015f gizli bir form, ba\u011flant\u0131 veya otomatik \u00e7al\u0131\u015fan istek bulunabilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">K\u00f6t\u00fc ama\u00e7l\u0131 i\u00e7erik, taray\u0131c\u0131 \u00fczerinden <code>domainadresiniz.com<\/code> adresindeki hassas bir i\u015flem noktas\u0131na istek g\u00f6nderir. Kullan\u0131c\u0131n\u0131n oturumu h\u00e2l\u00e2 a\u00e7\u0131ksa taray\u0131c\u0131 ilgili \u00e7erezi iste\u011fe ekleyebilir. Hedef uygulama ek bir do\u011frulama yapm\u0131yorsa i\u015flem ge\u00e7erli bir kullan\u0131c\u0131 talebi gibi i\u015flenebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sald\u0131r\u0131n\u0131n ger\u00e7ekle\u015febilmesi i\u00e7in sald\u0131rgan\u0131n hedef i\u015flem adresini ve gerekli parametreleri bilmesi gerekir. Kullan\u0131c\u0131n\u0131n aktif oturuma sahip olmas\u0131 ve uygulaman\u0131n CSRF korumas\u0131 kullanmamas\u0131 da sald\u0131r\u0131n\u0131n ba\u015far\u0131 ihtimalini art\u0131r\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-1024x429.png\" alt=\"\" class=\"wp-image-9095\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/hedef.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">CSRF Sald\u0131r\u0131lar\u0131 Hangi \u0130\u015flemleri Hedef Alabilir?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF sald\u0131r\u0131lar\u0131 \u00e7o\u011funlukla kullan\u0131c\u0131 hesab\u0131nda de\u011fi\u015fiklik olu\u015fturan i\u015flemleri hedefler. Sadece veri g\u00f6r\u00fcnt\u00fcleyen sayfalar yerine sunucu \u00fczerinde kal\u0131c\u0131 sonu\u00e7 olu\u015fturan istekler sald\u0131rganlar a\u00e7\u0131s\u0131ndan daha de\u011ferlidir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hedef al\u0131nabilecek i\u015flemler aras\u0131nda \u015funlar bulunabilir:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hesap e-posta adresinin de\u011fi\u015ftirilmesi<\/li>\n\n\n\n<li>Kullan\u0131c\u0131 parolas\u0131n\u0131n g\u00fcncellenmesi<\/li>\n\n\n\n<li>Yeni y\u00f6netici hesab\u0131 olu\u015fturulmas\u0131<\/li>\n\n\n\n<li>Kay\u0131tl\u0131 adres bilgilerinin de\u011fi\u015ftirilmesi<\/li>\n\n\n\n<li>Sipari\u015f veya \u00f6deme talebi ba\u015flat\u0131lmas\u0131<\/li>\n\n\n\n<li>Kullan\u0131c\u0131 hesab\u0131n\u0131n silinmesi<\/li>\n\n\n\n<li>Uygulama ayarlar\u0131n\u0131n g\u00fcncellenmesi<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Hassas i\u015flemler m\u00fcmk\u00fcn oldu\u011funca <code>GET<\/code> iste\u011fiyle ger\u00e7ekle\u015ftirilmemelidir. Veri de\u011fi\u015fikli\u011fi olu\u015fturan i\u015flemlerde <code>POST<\/code>, <code>PUT<\/code>, <code>PATCH<\/code> veya <code>DELETE<\/code> gibi uygun HTTP y\u00f6ntemleri kullan\u0131lmal\u0131 ve ayr\u0131ca istek do\u011frulamas\u0131 yap\u0131lmal\u0131d\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-1024x429.png\" alt=\"\" class=\"wp-image-9096\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-1536x644.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-990x415.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token-1320x553.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/token.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">CSRF Token Nedir?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF token, sunucu taraf\u0131ndan olu\u015fturulan ve kullan\u0131c\u0131n\u0131n g\u00f6nderdi\u011fi iste\u011fin g\u00fcvenilir bir sayfadan ba\u015flat\u0131ld\u0131\u011f\u0131n\u0131 do\u011frulamaya yard\u0131mc\u0131 olan \u00f6zel bir de\u011ferdir. Genellikle tahmin edilmesi zor ve yeterli uzunlu\u011fa sahip bir karakter dizisinden olu\u015fur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kullan\u0131c\u0131 bir form sayfas\u0131n\u0131 a\u00e7t\u0131\u011f\u0131nda sunucu ilgili oturum i\u00e7in token \u00fcretir. Bu de\u011fer form i\u00e7erisine gizli bir alan olarak eklenebilir. Form g\u00f6nderildi\u011finde token da di\u011fer bilgilerle birlikte sunucuya iletilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sunucu, gelen token de\u011ferini oturumla ili\u015fkilendirilen kay\u0131tla kar\u015f\u0131la\u015ft\u0131r\u0131r. De\u011ferler e\u015fle\u015fiyorsa i\u015flem devam eder. Token eksik, ge\u00e7ersiz veya ba\u015fka bir oturuma aitse talep reddedilir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-1024x429.png\" alt=\"\" class=\"wp-image-9100\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nasil-calisir-3.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">CSRF Token Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF token mekanizmas\u0131, sald\u0131rgan\u0131n yaln\u0131zca i\u015flem adresini ve form parametrelerini bilmesini yetersiz h\u00e2le getirir. Ge\u00e7erli iste\u011fin olu\u015fturulabilmesi i\u00e7in sunucunun \u00fcretti\u011fi \u00f6zel token de\u011ferine de ihtiya\u00e7 duyulur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Basit bir form i\u00e7erisinde token \u015fu \u015fekilde bulunabilir:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;form method=\"POST\" action=\"\/hesap\/e-posta-degistir\">\n    &lt;input type=\"hidden\" name=\"csrf_token\" value=\"sunucu-tarafindan-olusturulan-deger\">\n    &lt;input type=\"email\" name=\"email\">\n    &lt;button type=\"submit\">G\u00fcncelle&lt;\/button>\n&lt;\/form>\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Form g\u00f6nderildi\u011finde sunucu \u00f6nce kullan\u0131c\u0131n\u0131n oturumunu kontrol eder. Ard\u0131ndan <code>csrf_token<\/code> alan\u0131ndaki de\u011ferin ge\u00e7erlili\u011fini do\u011frular. \u0130ki kontrol de ba\u015far\u0131l\u0131 oldu\u011funda e-posta de\u011fi\u015ftirme i\u015flemi ger\u00e7ekle\u015ftirilebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sald\u0131rgan ba\u015fka bir sayfadan benzer form haz\u0131rlasa bile ge\u00e7erli token de\u011ferine eri\u015femedi\u011fi i\u00e7in sunucu iste\u011fi kabul etmez.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-1024x429.png\" alt=\"\" class=\"wp-image-9097\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/oturum.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">G\u00fcvenli Bir CSRF Token Nas\u0131l Olu\u015fturulmal\u0131d\u0131r?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF token de\u011ferleri g\u00fcvenli bir rastgele say\u0131 \u00fcreticisi kullan\u0131larak haz\u0131rlanmal\u0131d\u0131r. K\u0131sa, s\u0131ral\u0131 veya kolay tahmin edilebilen de\u011ferler sald\u0131rgan taraf\u0131ndan \u00fcretilebilir. Token i\u00e7erisinde kullan\u0131c\u0131 ad\u0131, tarih veya hesap numaras\u0131 gibi bilinen verilerin do\u011frudan kullan\u0131lmas\u0131 uygun de\u011fildir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Token kullan\u0131c\u0131 oturumuyla ili\u015fkilendirilmeli ve ba\u015fka bir hesapta ge\u00e7erli olmamal\u0131d\u0131r. Oturum sona erdi\u011finde mevcut token de\u011ferinin de ge\u00e7ersiz h\u00e2le gelmesi g\u00fcvenli\u011fi art\u0131r\u0131r. Kritik i\u015flemlerde token kullan\u0131m s\u00fcresi ayr\u0131ca s\u0131n\u0131rland\u0131r\u0131labilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Token de\u011ferleri URL i\u00e7erisine eklenmemelidir. URL\u2019ler taray\u0131c\u0131 ge\u00e7mi\u015finde, sunucu g\u00fcnl\u00fcklerinde veya y\u00f6nlendirme bilgilerinde kaydedilebilir. Bunun yerine form g\u00f6vdesi ya da uygun bir \u00f6zel HTTP ba\u015fl\u0131\u011f\u0131 kullan\u0131lmal\u0131d\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-1024x429.png\" alt=\"\" class=\"wp-image-9098\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/samesite.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">SameSite \u00c7erez \u00d6zelli\u011fi CSRF Sald\u0131r\u0131lar\u0131n\u0131 Engeller mi?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>SameSite<\/code> \u00e7erez \u00f6zelli\u011fi, \u00e7erezlerin farkl\u0131 bir web sitesinden ba\u015flat\u0131lan isteklerde g\u00f6nderilip g\u00f6nderilmeyece\u011fini s\u0131n\u0131rland\u0131r\u0131r. <code>Lax<\/code> veya <code>Strict<\/code> se\u00e7enekleri bir\u00e7ok CSRF sald\u0131r\u0131s\u0131n\u0131n ger\u00e7ekle\u015fmesini zorla\u015ft\u0131rabilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ancak uygulaman\u0131n g\u00fcvenli\u011fi yaln\u0131zca <code>SameSite<\/code> ayar\u0131na ba\u011flanmamal\u0131d\u0131r. Taray\u0131c\u0131 uyumlulu\u011fu, alt alan adlar\u0131, y\u00f6nlendirme yap\u0131lar\u0131 ve uygulaman\u0131n \u00e7al\u0131\u015fma gereksinimleri koruman\u0131n kapsam\u0131n\u0131 etkileyebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hassas i\u015flemlerde CSRF token, g\u00fcvenli \u00e7erez ayarlar\u0131 ve istek kayna\u011f\u0131 kontrolleri birlikte kullan\u0131lmal\u0131d\u0131r. <code>Secure<\/code> \u00f6zelli\u011fi \u00e7erezin yaln\u0131zca HTTPS ba\u011flant\u0131lar\u0131nda iletilmesini sa\u011flarken <code>HttpOnly<\/code>, istemci taraf\u0131ndaki kodlar\u0131n oturum \u00e7erezine eri\u015fmesini s\u0131n\u0131rland\u0131r\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-1024x429.png\" alt=\"\" class=\"wp-image-9099\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-1024x429.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-300x126.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-1536x643.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-990x414.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir-1320x552.png 1320w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/nedir.png 1938w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">CSRF Korumas\u0131nda Yap\u0131lan Hatalar Nelerdir?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Token olu\u015fturmak tek ba\u015f\u0131na yeterli de\u011fildir. Sunucu taraf\u0131nda token do\u011frulamas\u0131n\u0131n yap\u0131lmamas\u0131, korumay\u0131 etkisiz h\u00e2le getirir. Baz\u0131 uygulamalarda yaln\u0131zca belirli formlar korunurken di\u011fer veri de\u011fi\u015ftiren i\u015flem noktalar\u0131 a\u00e7\u0131k b\u0131rak\u0131labilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF token de\u011ferinin sabit tutulmas\u0131, farkl\u0131 kullan\u0131c\u0131lar aras\u0131nda payla\u015f\u0131lmas\u0131 veya kolay tahmin edilebilir bi\u00e7imde \u00fcretilmesi de g\u00fcvenlik riski olu\u015fturur. Ayr\u0131ca yaln\u0131zca JavaScript taraf\u0131nda yap\u0131lan kontroller sunucu do\u011frulamas\u0131n\u0131n yerini tutmaz.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uygulamadaki XSS a\u00e7\u0131klar\u0131n\u0131n CSRF korumas\u0131n\u0131 zay\u0131flatabilece\u011fi unutulmamal\u0131d\u0131r. Zararl\u0131 kod g\u00fcvenilir sayfa i\u00e7erisinde \u00e7al\u0131\u015ft\u0131r\u0131labiliyorsa token de\u011ferini okuyabilir veya kullan\u0131c\u0131 ad\u0131na i\u015flem ba\u015flatabilir. Bu nedenle XSS ve CSRF \u00f6nlemleri birlikte de\u011ferlendirilmelidir.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sonu\u00e7<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF sald\u0131r\u0131s\u0131, kullan\u0131c\u0131n\u0131n aktif oturumundan yararlanarak bilgisi d\u0131\u015f\u0131nda i\u015flem ger\u00e7ekle\u015ftirilmesini ama\u00e7lar. CSRF token kullan\u0131m\u0131, iste\u011fin g\u00fcvenilir uygulama sayfas\u0131ndan g\u00f6nderildi\u011fini do\u011frulamaya yard\u0131mc\u0131 olur. G\u00fcvenli token \u00fcretimi, sunucu tarafl\u0131 do\u011frulama, uygun HTTP y\u00f6ntemleri ve korumal\u0131 \u00e7erez ayarlar\u0131 birlikte uygulanmal\u0131d\u0131r.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/domainhizmetleri.com\/limitsiz-hosting\/\" target=\"_blank\" rel=\" noreferrer noopener\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"290\" src=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1024x290.png\" alt=\"\" class=\"wp-image-8461\" srcset=\"https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1024x290.png 1024w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-300x85.png 300w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1536x435.png 1536w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-scaled.png 2048w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-990x280.png 990w, https:\/\/www.domainhizmetleri.com\/blog\/wp-content\/uploads\/Limitsiz-hosting-reklamm-1320x374.png 1320w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Domainhizmetleri olarak h\u0131zl\u0131, g\u00fcvenli ve stabil hosting altyap\u0131m\u0131zla web projelerinize uygun \u00e7\u00f6z\u00fcmler sunuyoruz. G\u00fcvenlik katmanlar\u0131yla desteklenen hosting hizmetlerimizden yararlanarak web sitenizin daha g\u00fcvenli bir ortamda yay\u0131nlanmas\u0131n\u0131 sa\u011flayabilirsiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Web uygulamalar\u0131nda kullan\u0131c\u0131 oturumlar\u0131 genellikle \u00e7erezler arac\u0131l\u0131\u011f\u0131yla y\u00f6netilir. Kullan\u0131c\u0131 bir web sitesinde oturum a\u00e7t\u0131\u011f\u0131nda taray\u0131c\u0131, sonraki isteklerde ilgili oturum \u00e7erezini otomatik olarak sunucuya g\u00f6nderir. Bu \u00e7al\u0131\u015fma bi\u00e7imi kullan\u0131m kolayl\u0131\u011f\u0131 sa\u011flarken gerekli g\u00fcvenlik \u00f6nlemleri al\u0131nmad\u0131\u011f\u0131nda CSRF sald\u0131r\u0131lar\u0131na zemin haz\u0131rlayabilir. Bu rehberde CSRF sald\u0131r\u0131s\u0131 nedir, hangi i\u015flemleri hedef al\u0131r ve CSRF token nas\u0131l \u00e7al\u0131\u015f\u0131r sorular\u0131n\u0131 ele al\u0131yoruz. [&hellip;]<\/p>\n","protected":false},"author":17,"featured_media":9093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,145],"tags":[316],"class_list":["post-9090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bilim-ve-teknoloji-dunyasi","category-nedir-nasil","tag-csrf"],"views":2,"_links":{"self":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/comments?post=9090"}],"version-history":[{"count":2,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9090\/revisions"}],"predecessor-version":[{"id":9101,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/posts\/9090\/revisions\/9101"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/media\/9093"}],"wp:attachment":[{"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/media?parent=9090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/categories?post=9090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.domainhizmetleri.com\/blog\/wp-json\/wp\/v2\/tags?post=9090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}