I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected from CSRF given that the frontend and backend are hosted on different servers?

Basically the Apache server needs to issue CSRF tokens and the Tomcat server be able to recognize them. Assume they are under the same domain.

  • 4
    Possible duplicate of CSRF protection and Single Page Apps
    – Michael
    Jan 4, 2016 at 11:11
  • I do not feel that this is a duplicate of "CSRF protection and Single Page Apps" as this question is asking about difficulties that arise when you don't have a shared database between the server that generates the page and the server that processes the form. Jan 4, 2016 at 21:06

1 Answer 1


In order to implement CSRF protection, you need a token that is secret in the sense that it can't be calculated by an attacker. You can use a modification of the encrypted token pattern from the OWASP CSRF cheat sheet.

You can either use a shared secret key between the front-end and back-end or a public/private key, storing the public key on the front-end and the private-key on the back-end. You then encrypt the user ID and timestamp on the front-end to use as your CSRF token and verify it on the back-end. Instead of encryption you can sign the data using an HMAC or a digital signature. All of the options (asymmetric encryption, symmetric encryption, HMAC, and digital signatures) will produce the desired token properties of being easy to verify but effectively impossible to predict.

The OWASP document suggests that you encrypt the user id, timestamp, and a nonce, but I believe that the nonce is unneeded. See this question and the comment on the OWASP discussion page for more information.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .