Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a RESTful API to work with my AngularJS application.

Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using FormsAuthentication.Encrypt. This approach could result in the authentication cookie being stolen, however that problem is out of scope for this question.

The question is about generating an CSRF token. I want to generate the token based on the authentication cookie, that way when the user logs out (or logs out and back in) the token will be invalidated. Problem with generating a token for each form is that then the form could expire before the authentication expires. I want forms to remain valid for as long as the user is logged in.

If the authentication cookie is hijacked, all security is lost anyways. Because of that I don't see any added risk to the CSRF token relating to the authentication cookie. The token will be sent to the client as cookie, and to the server as header.

Additionally I'll check referer/origin headers, but that's out of the scope for this question.

Some example:

# URL that doesn't require authentication
GET /api/security/session HTTP/1.1
HOST localhost:1234

HTTP/1.1 200 OK
Set-Cookie: .ASPXAUTH=SomeLongHexCodeHere; Expires=...; HttpOnly
Set-Cookie: CSRF-Token=TheToken; Expires=...;

# URL that does require authentication
GET /api/account/data
HOST localhost:1234
X-CSRF-Token: TheToken

For generating the CSRF Token I was thinking about generating a salted hash from the .ASPXAUTH cookie. Would this suffice in the protection against CSRF, assuming XSS is blocked and the authentication cookie isn't hijacked?

Two final notes. Although my code runs on the ASP.NET platform, it's not using any of the ASP.NET technologies (WebForms, WCF, MVC, WebAPI, etc.) and cannot use their CSRF protection methods. Secondly the site doesn't use SSL, and sadly won't use SSL. It'll be vulnerable to MITM attacks, and there's not too much I can do about it.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

For generating the CSRF Token I was thinking about generating a salted hash from the .ASPXAUTH cookie. Would this suffice in the protection against CSRF, assuming XSS is blocked and the authentication cookie isn't hijacked?

The answer is yes, it's sufficient, assuming you have marked the ASPXAUTH cookie as HttpOnly.

The token needs to be a hard-to-guess value that the server can correlate with the session cookie. A hash of the cookie works quite well. Since it is HttpOnly, scripts running on the browser will be unable to read it and won't be able to forge the hash.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.