Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now imagine the following scenario:
The user opens a browser tab (tab
anonymous) and starts some AJAX functionality that periodically reads from the server (e.g. a timestamp). The user is not authenticated in this tab.
The user opens a new browser tab (tab
authenticated) and performs a login there. If he now loads the AJAX framework, the CSRF token gets written into the source code of the AJAX framework by server-side includes and gets stored in the variable
If the next automatic poll is done from tab
anonymous, the session cookie gets submitted indicating a logged in user but this tab never received a CSRF token since the AJAX framework was loaded before performing the login on tab
This will result in an error thrown by the server because it received a valid session token without CSRF protection token.
How do I overcome this?
Things get even worse if the user
- does a login on tab 1 (
- opens tab 2
- does a logout on tab 2
- performs a new login on tab 2 (different user,
In that case, the first tab provides the formerly valid CSRF token of
user1 but the submitted session cookie belongs to
user2 logged in on tab 2. This must lead to an error issued by the CSRF protection (by the way, in terms of HTTP error codes: what to use?
403 looks as if it could be used but I'm unsure).
Feeling now like the whole CSRF thing could be solved very nice in theory but could use some thinking in times of AJAX.
Is there any canonical solution for the issue described above? Or do users simply accept that they have to reload a page due to security-thingies-don't-match stuff?