We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF.

So, what if we combine them in this manner:

1) Use access JWT token with csrftoken property in its payload and store this token in httpOnly and secure cookie and

2) Use csrftoken and store it in local storage. JWT token and csrftoken are submitted to a client on successful authorization. Browser submits JWT token to the server on each request and application passes scrftoken in a header. Server checks if csrftoken from JWT and header match and if not - blocks the request.

It seems like this scheme will protect us from both types of attacks. Malicious code injected to a page will not get access to JWT token (so no XSS) and malicious code run by a user outside our site will not force this user submit his/her csrftoken in a header (so, no CSRF).

So, I wonder if is a good practice and do they use this scheme in real world applications.

  • This sounds like a novel concept to me. But, I don't understand the purpose of doing this(or why this is better than current practice of keeping xss and csrf protection separate). You are sending CSRF token with every request anyway and setting both cookie flags(httponly and secure) for the JWT token. – ramailo sathi Sep 1 '17 at 4:47
  • This only applies when you use session based anti CSRF tokens. You don't have this problem when using request based anti CSRF tokens. – Jeroen Sep 1 '17 at 5:47
  • @Jeroen - IT Nerdbox. Could you, please, a bit elaborate on how session based anti CSRF tokens differ from request based anti CSRF tokens? I'm not quite sure what it may mean. – Jacobian Sep 1 '17 at 6:56
  • In session based anti CSRF token, the anti CSRF token is always the same during the entire session. In request based anti CSRF tokens, in each request, a new anti CSRF token is generated. – Jeroen Sep 1 '17 at 7:01
  • In my scheme CSRF token will stay the same as long as access JWT token is not expired. – Jacobian Sep 1 '17 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.