4

So I have developed a web application, which also has an API.

API supports both GET and POST requests. The API is completely stateless, means nothing is stored or modified in a database/file when using it. The API (currently!) needs an authentication cookie to be used.

Does this system have CSRF problems? I'm pretty sure it doesn't (as using the API doesn't change a server-side state), but I wanted to make sure..

2
  • Unless you have any way to detect whether a request is made directly by a user or whether the request may have been automated from another page while the user is authenticated, then it is technically vulnerable to CSRF. In order to be able to answer your question more completely, you would need to provide more details about your web application. Dec 12, 2015 at 22:48
  • Technically the web app is vulnerable, but the only danger of CSRF is, that one could trigger malicious actions in a user's name, even if he hasn't done them. So as long as a user can't do anything wrong with an API, a hacker which abuses the API with CSRF can't do either, correct? I mean he still can't see the responses by the API, he can only "guess" what's really happening. Dec 12, 2015 at 23:41

1 Answer 1

3

With CSRF the attacker is able to control a request sent to another site. But the attacker is unable to read the response. Since your API is purely informative and does not cause any changes to the server the cross site request is still possible but will not cause any permanent problems.

But depending on the abilities of your API it might still be possible that the attacker is able to trigger a high resource usage at the server by using unexpected parameters for the request. This might result in a denial of service for the proper users of the API. Thus it might still be worth to detect and block CSRF requests.

Also, even though CSRF itself is not possible other attacks like DNS rebinding or Cross Site Scripting might still be possible. Contrary to CSRF these attacks then have also access to the response data.

1
  • That's exactly what I wanted to be confirmed. Thank you! :) Dec 13, 2015 at 8:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .