0

In my previous question, John Wu advised me to use a per session CSRF token, and told me to ask another question about guarding the CSRF Token.

How can I guard a CSRF token which is a per-session type one, so that it can not be stolen by an attacker?

Improve this question
0

1 Answer 1

Reset to default
2

There is little you can or need to do to guard the CSRF token. Perhaps there is more, but I can only think of four things:

  • Don't put it in a URL parameter where it will be logged in all sorts of places.
  • If you are only serving your site over HTTPS, mark any cookies involved as secure.
  • Invalidate the token both client side (via cookie settings) and server side so that old tokens can not be used.
  • Be careful with CORS so that you do not accidentally make something containing the token available from another origin.

And then there is the issue of XSS. If you are vulnerable to that, it could be used to steal the CSRF token, since it can not be HTTP-only. There is nothing you can do about this, other than making sure you are not vulnerable to XSS. Use CSP, sanitize your input with a good library, scan your site, etc, etc.

However, if you have XSS issues you have bigger problems than the CSRF token being stolen.

Improve this answer
4
  • Hello, thanks for the answer, what is "CORS" and "SOP" ? And how can I make sure that I am not vulnerable for a XSS ? Thank you.
    – googol8080
    Commented Sep 20, 2016 at 11:38
  • CORS = Content Origin Resource Sharing. (If you are not using it, you do not need to worry about it.) SOP = Single Origin Policy (Not mentione in this answer, though.) How to protect against XSS is a huge topic. I give some pointers in my answer, here is one more.
    – Anders
    Commented Sep 20, 2016 at 11:54
  • I do not get the meaning of the untrusted data owasp was saying.
    – googol8080
    Commented Sep 20, 2016 at 12:01
  • Untrusted data is data that could potentially contain attacks (e.g. data provided by users in forms or URL paramters or HTTP headers or whatever).
    – Anders
    Commented Sep 20, 2016 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .