What should I do in case of a cross site request forgery attack?

I’m trying to prevent CSRF attacks. I’ve stored a random value in the session and in the form. When processing the form, I compare the two values. If the session and开发者_StackOverflow the form value aren’t equal, should I kill the script or is there a better way to handle this?

If this is very unlikely to happen from a real user, then I would prevent the script from saving/returning any data, but I would return a 'success' message as if it had worked. If you return a failure, it helps hackers to work out how your validation is coded.

On the other hand, if this happens to real users, I would return a friendly error, and possibly ask them to log in again.

Yes. Just let it fail. There is no point in recovering such errors.

What you should do however is also write a log entry to audit potential exploit attempts:

syslog(LOG_ERR, "CSRF token mismatch ...");
die("Request failed. (Disabled cookies?) Contact administrator: ...");

Include a humd-readable message in case it was really a browser error or something. But don't expose that it was the CSRF token that failed.