User login to my Web API Service using his user name and password.
Web API Service response auth token to client browser.

Client browser save auth token to session storage using JavaScript.
Client page use regular expression to validate every user's inputs.
Client send Ajax requests attached auth token to Web API Service.

Web API service use regular expression to validate data which come from every Ajax request.

By using this approach do I still need anti-forgery token to keep in client page as hidden?

2 Answers 2


Browser session storage isn't automatically sent by the browser when a cross domain request is initiated. Therefore, as you are adding the auth token manually, this acts as a CSRF defence in its own right and does not need any further protection.

I'm assuming there's a one-to-one relationship between website and web API here. If not, there is the possibility that a consumer of your API is making cross-domain requests to another consumer. To combat this, you should tie in the user session to the identifier of the website which made the original authentication request, and check this for each further request to mitigate CSRF.

  • My service used web api cors which origin is only allowed to specific domain. Commented Dec 19, 2015 at 10:15

Yes, you do still need an anti-CSRF implementation of some kind as you're still not able to verify the origin of the request.

To make a CSRF attack a little bit more clear, please have a look at this diagram:

The process of a CSRF attack

An implementation of anti-CSRF, using PHP, can be found here.

  • Sorry if i made you confuse, my current practice is i don't use browser cookie to save app auth token key, i just used html 5 session storage. So is this still possible to be csrf attack? Commented Dec 19, 2015 at 7:54
  • Thanks for the clarification. When the session storage object is used, it is available only to that window/tab until the window is closed. This means that my suggestion above is not valid for your situation.
    – Jeroen
    Commented Dec 19, 2015 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .