1

I have implemented the OWASP CSRFGuard library to protect my application against CSRF attacks. I'm using the CSRFGuard JavaScript file and servlet to inject CSRF tokens in all the Ajax requests. So far I'm seeing that the token is being properly added to all requests.

My question is how to validate that this token is valid and recognized by the library on the server side? I can get the the token to the server side but I have nothing to compare with. My concern is that an attacker could inject any value and the app wouldn't know if this is valid or not.

I have deleted and altered this token from requests and noticed that the filter is not rejecting them, so I assume that the validation of this token is something that I have to implement in my servlet, right? But how? I have looked at the CSRFGuard classes but haven't found any that stores the token generated by the JavaScript servlet.

1

After exploring the code for a couple weeks trying to find a way to validate the token on the server side, I found that it is stored in the HttpSession session variable. Look at the fetchCsrfToken method from the JavaScriptServlet class .

Based on that, I'm validating the token at server side as follows:

String CSRFToken = request.getHeader("OWASP_CSRFTOKEN");
if(CSRFToken.equals(tokenValue)) { 
    // Code to execute if the token is valid 
} else { 
    // Code to execute if the token is not valid
}

I hope this is helpful to others who use the OWASP CSRFGuard library.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.