How to prevent (cookieless) csrf attack?

Question

This is a real world scenario. I'm trying to provide all the details necessary.

Summary

A user changes their IP with every request using a cookieless browser. How can I secure their login requests?

Setup

• Restful API and thin JS web client
• CSRF Token GET Endpoint that generates csrf token which is tied to requesting IP
• Login POST Endpoint using parameters email, password and csrf_token
• Access-Control-Allow-Origin is set, so responses can only be retrieved from non attacker website. However pre-flight request is not issued as per specs.
• There is a request cooldown per IP Address
• User using browser that is cookieless and has no local storage
• User changing their IP Address every request, e.g. using Tor or Onavo

Problem

Since the IP address changes for every request, the csrf token is never valid and the user can not log in.

We could stop associating the csrf token with the IP. However then we would allow an attacker to generate their own csrf token and send it to the user (which defeats the whole purpose). I.e. the attacker could now rate limit a user in the background and prevent them from logging in when they visit our site.

Question

The only reference I found suggested to use cookies (which we can't do).

What should we best do here to allow the user to log in while still preventing csrf?

Answer 1

So this is a REST-ful API that you're working with and your clients are using browsers that don't support cookies, ergo authentication to your API is done via an Authorization header? And I take it that the contents of this Authorization header are populated per the contents of the response from the login API endpoint?

If this is the case, your API is already protected against CSRF. CSRF against the login endpoint would only work if the response from the server set a cookie within the victim's browser which was then used to authenticate subsequent requests.