What happens first in a request having both CSRF Token and JWT token, authentication or authorization?

Question

This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.

403 error means that the request was unauthorized.

I know that while using django, using csrf token is neccessary. But lets take an example where I am using jwt tokens for user authentication and csrf token for request authorization. What will happen first? Authentication or authorization?

The simple answer I found while surfing the web was the Authentication ALWAYS occurs before Authorization. But this statement seems contrary to the error I recieved where the request was unauthorized even before the authentication process started. So what is happening here?

Extending my initial question, if I securely use JWT tokens, is using csrf token for protection against csrf attacks really neccessary (talking in general, not specific to django)? Won't JWT serve the purpose for both? What is the industry standard in such a use case?

Answer 1

If the CSRF token is bound to a security session, the server must first establish the session before it can validate the CSRF token. And the session is established only after successful authentication, the authentication must come before the CSRF token validation (authorization).

Regarding your last question, CSRF protection is only necessary for requests made by a client (for example, a browser) that silently adds credentials for the current user, by sending a session cookie, a JWT in a cookie, resending username and password that were previously typed in ("Basic Authentication") or by including a client certificate. If the request is authenticated via a JWT that is transported in an Authorization: Bearer <JWT> header, none of the above applies, therefore a CSRF token does not give additional protection.