2

I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is not possible to forge a JSON request to do an unintented operation in this case?

https://github.com/pillarjs/understanding-csrf#use-only-json-apis

Considering that the allowed encType for forms are application/x-www-form-urlencoded, multipart/form-data and text/plain it totally make sense...

2

They are still susceptible in XSS attacks, plain/text json enforcement, and if the origin policies aren't setup right. It's been answered before on Stack Overflow, but not here really. The answer on Stack Overflow can be found here but I'll synopsis here for archival sake:

Forms are limited to two methods: GET and POST
Forms are limited to three content types: application/x-www-form-urlencoded, multipart/form-data, and text/plain

Since you're posting over content type application/json you need to use XMLHTTPRequest submission which is locked down with Origin Policies(Same, Cross) so now it depends on the server.

However if the form generates valid JSON but sets the content type to text/plain and the server doesn't check that then CSRF is still possible if all the server is doing is parsing the data without checking the content type.

So really it's up to the server to check the post request, only allow content type application/json and use correct origin policies to prevent CSRF with a JSON API. Remember CSRF is always dependent on the server to prevent the attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.