I was reading about XSRF and I'd like to ensure that I understand the problem correctly and know if my application is protected against that kind of attack.
How I understand CSRF works:
- adding a random(?) string which is saved in your cookie by
set-cookie), in theory it can be accessed only from the domain it was set
- that string is validated with every request by the API to ensure that request isn't made from different origin
Solution I have currently:
- session is set by the server after user authentication(login) and its ID is set as HTTPS only cookie
- session ID is long random string saved in DB with information about users browser user agent string, IP and user ID
- JS can't access the cookie, all requests are set with
XMLHttpRequest.withCredentialsto pass cookie to server
- session ID is validated with every request also against user agent and IP
- session is valid by 10 mins but can be extended
- I have CSP set to allow content only for a few trusted domains
- I have CORS setup to allow requests from trusted origins only
As I see my session ID acts a bit similar to CSRF token. I'd like to know do I need additional CSRF token to prevent XSRF or solution I have currently covers that vulnerability in satisfying way?
Security is area which I am new in and I don't feel confident I appreciate any help.