Not convinced on the security of a JWT Token + CSRF Token

Question

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this:

1. When a user logs in, the client sends a login request.
   
2. Server sets a signed JWT token as a cookie with Set-Cookie ... ;Secure ;httpOnly in its response header. This prevents XSS attacks since the cookie cannot be accessed by Javascript.
   
3. Server also sends a CSRF token without httpOnly set so that it can be read by JavaScript code.
   
4. When the client makes any future requests, the JWT cookie will automatically be sent and the CSRF will have to be set in the request header. This should prevent CSRF attacks since the CSRF cookie will have to be read.
   

So in short we have:

• Setting the JWT token with ;Secure;HttpOnly will prevent XSS attacks.

• Making the client set the CSRF cookie in the request header will prevent CSRF attacks.

But what if an attacker gets your CSRF token using XSS and sets it as a header for requests sent by a malicious website with a CSRF exploit. Is this attack possible? If so, how could I improve my authentication scheme?

Thanks in advance.

Answer 1

CSRF will have to be set in the request header.

The anti-CSRF-token will be submitted in the request message body. If there is a XSS-vulnerability and an attacker manages to exploit it, the last thing he will probably care about is the anti-CSRF-token. XSS is a much more powerful attack, and an attacker can manipulate almost anything with XSS.

Also, the anti-CSRF-token is stored in a hidden form field in the html-code.

It exists so that each request is bound to a specific user-session. It literally exists to make CSRF impossible, even if the token somehow leaks. An attacker would only be able to manipulate the current, active session of that particular user whom he stole the anti-CSRF token from.

But what if an attacker gets your CSRF token using XSS and sets it as a header for requests sent by a malicious website with a CSRF exploit. Is this attack possible?

The JWT would still be protected. I suggest you should read up on how CSRF works: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)