This is a real world scenario. I'm trying to provide all the details necessary.
A user changes their IP with every request using a cookieless browser. How can I secure their login requests?
- Restful API and thin JS web client
- CSRF Token GET Endpoint that generates csrf token which is tied to requesting IP
- Login POST Endpoint using parameters email, password and csrf_token
- Access-Control-Allow-Origin is set, so responses can only be retrieved from non attacker website. However pre-flight request is not issued as per specs.
- There is a request cooldown per IP Address
- User using browser that is cookieless and has no local storage
- User changing their IP Address every request, e.g. using Tor or Onavo
Since the IP address changes for every request, the csrf token is never valid and the user can not log in.
We could stop associating the csrf token with the IP. However then we would allow an attacker to generate their own csrf token and send it to the user (which defeats the whole purpose). I.e. the attacker could now rate limit a user in the background and prevent them from logging in when they visit our site.
What should we best do here to allow the user to log in while still preventing csrf?