We have a simple webapp where a user will have to create an account. To verify their email address (which will be used to send notifications later for business purposes, which is one of the core features of the application), we send an activation link.
Our activation link leads to a different sub-domain. Because of this, and the ability for the user to open this activation link on a different computer/browser (such as on your PC instead of on your phone), the user would need to get a new CSRF token when following the activation link.
When activating your account, you do not need to be logged in. (You could be logged in, but not to the account that you're activating.)
So when activating their account, the following happens:
- the user clicks on the link,
- the front-end which handles such requests opens,
- the front-end makes a pre-flight request to our server to obtain a CSRF token,
- the front-end receives the CSRF token,
- the front-end uses the parameters passed in the url to send an activation request to our server.
- The server sends back the appropriate response after handling the request
- The front-end displays the appropriate page based on the response ("It succeeded, click here to login" or "Your account was already activated, click here to login" or "activation link expired", etc.)
Key point here is that the person who activates an account does not gain any special rights. We don't automatically log the person who activates their account in. People still have to do that themselves.
So then I'm left wondering - why do I need this CSRF token? The activation link contains a activation token, so anyone capable of activating an account either got really lucky or has actually received the email. If an attacker activated an account, all that would happen is "the account is activated".
I'd like to take the CSRF token out of this process to speed up the process (particularily for people with high latency internet). Would I be weakening my security if I took the CSRF token out of the process, so that the process resolves to this:
- the user clicks on the link,
- the front-end which handles such requests opens,
- the front-end uses the parameters passed in the url to send an activation request to our server.
- The server sends back the appropriate response after handling the request
- The front-end displays the appropriate page based on the response ("It succeeded, click here to login" or "Your account was already activated, click here to login" or "activation link expired", etc.)
TL;DR: Does a CSRF token add security for REST end-points where you don't need to be logged in?