0

If my site only responds to requests from it's own domain, does it make sense to implement CSRF tokens on my requests?

I believe it is the Cross-Site in CSRF that's leading me to ask this question.
If cross-site requests are just ignored, does the CSRF Anti-Frogery token add any value?

Improve this question

1 Answer 1

Reset to default
1

Cross Site Request Forgery is by definition a cross-site request. If cross-site requests are not accepted by your application (i.e. everything same-site) then of course CSRF is not a problem. But, make sure that you properly check if this request is really a same-site request. This means especially that you should not allow empty Referer headers because these can be created by cross-site requests and that you should not check the Referer header with an overly permissive regular expression.

Improve this answer
2
  • 3
    Just relying on the referrer is still risky though. E.g., if the website has social features (users can post links, images) or a usually quite harmless open redirect vulnerability, these features could be used by an attacker to get a trusted referrer attached to their requests.
    – Arminius
    Aug 1, 2017 at 12:51
  • Yeah, Referrer [sic] is not a security feature and should not be treated as one. Some browsers (notably Chrome) actually do support site origin info you can rely upon, at least for certain request types (notably POSTs), but they did it in a way that is not standardized and breaks some web apps (they extended the Origin header, which used to be only for cross-site requests). It might go away in the future.
    – CBHacking
    Sep 1, 2017 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .