I've been reading about CSRF and how it works, and, if I understood correctly, the 'only' thing an attacker can do is force the user to perform actions he didn't intend.
I understand the danger if we have a service such as /moneytransfer?from=user&to=attacker.
However, if a service merely updates the user's cookie values, then CSRF would give nothing to the attacker, correct? Is there some danger of the attacker to glimpse cookie OR response content without XSS? Would CSRF protection even be needed in such a case?
I apologize, I'm afraid I didn't make myself too clear...
Let's say I have a cookie with a session ID. Each time the user accesses the service:
... he gets back a cookie with Auth-Cookie=#SessionId.
For authentication, instead of the cookie, the server would expect the session in an HTTP Header, such as:
In such a case, a call to the /getSession service by an attacker would simply give the user a new session cookie.
In a scenario like this, would CSRF ever be a danger?
(This is all hypothetical, I know there are much better ways to make authentication. I'm a newcomer to security, and I'm just really trying to understand the limits of CSRF, and which types of service would need protection).