I have CSRF tokens everywhere on my e-commerce site that use POST forms. However, I don't want to start a session (with a cookie) unless absolutely necessary (mainly because I'm using varnish cache, and I don't want to hit the backend server unless absolutely necessary, even with ESI).
That means if the user is just browsing the catalog, then no session is created. (If they visit the login or signup pages, then a session IS created in order to create a CSRF token for the login/signup form - but that's no problem, since they're about to login anyway.).
The POST form for "add to basket" on the product page is causing me some problems.
I want to protect "add to basket" with CSRF Tokens (for example, an attacker could use CSRF to add other products to their basket). But I don't want to add a CSRF token to each product page, since that would start a session, meaning every product view would need to hit the backend to fetch the token.
So, what I've done is, when a user without a session adds a product, then no CSRF is needed. Then when the product is added, a session is created (so that the basket can be used), and all subsequent product-page views have forms that use CSRF.
Is this bad practise? As far as I can see, any "csrf attack" on the add-to-product can't do any damage.
(I know that it's unlikely that anybody will bother doing a CSRF attack on an add-to-basket page..and even if they did, it's probably not a huge problem anyway... I'm just interested in doing things "right").
(Checking origin/referer headers is also something to consider.)
Many thanks :)
