OWASP CSRFGuard obtains the token via XMLHttpRequest - why?

Question

I want to use the CSRFGuard Project to protect a legacy Java webapp against CSRF attacks. The latest published Maven dependency version is 3.1.0, which is what I use.

This is part of the JavaScript code that is included on every protected page:

var xhr = window.XMLHttpRequest ? new window.XMLHttpRequest : new window.ActiveXObject("Microsoft.XMLHTTP");
var csrfToken = {};
xhr.open("POST", "/JavaScriptServlet/", false);
xhr.setRequestHeader("FETCH-CSRF-TOKEN", "1");
xhr.send(null);

var token_pair = xhr.responseText;
token_pair = token_pair.split(":");
var token_name = token_pair[0];
var token_value = token_pair[1];

It is a separate JS file generated by a dedicated servlet, with no-cache headers.

I do not understand why the token name and value are not directly embedded into the generated JavaScript, but instead fetched via a synchronous (!) AJAX call.

Are there any vulnerabilities if I change it to include the token directly?

Answer 1

Are there any vulnerabilities if I change it to include the token directly?

Oh yeah.

Then an attacker could just include that script on their page:

<script src="http://yourserver.tld/yourpart"></script>

And let it run this code:

var token_name = "sample-token-name";
var token_value = "sample-token-value";

Then both token_name and token_value will not be global variables on the attacker's page that can be accessed and used to create the CSRF attack.

The reason they are using AJAX to get the token is that this request would fail if the attacker just includes the script tag because of same-origin policy.

As for why they are using synchronous AJAX, I doubt there is a reason except poor design.