1

We have a system that does async request to backend to get CSRF (via AJAX). The response from the server is a new cookie and a header that we remember in javascript and use later.

It all works fine until we open two tabs, then the first tab remembered token does not match the new cookie because it was re-issued. The plan to fix this is to check if CSRF token already exists in a cookie and to return existing one if it's good.

It seems like a good and secure fix, but I would like to double check here that there are no drawbacks to this solution.

  • Why is the CSRF token in a cookie at all? To "double submit" the token and check against header CSRF token value? Also, in the two tabs case, if the check for token validity only being done against the token in the cookie? – katrix Oct 11 '17 at 19:35
  • 1
    I may be wrong but putting CSRF into the cookie defeats the purpose of a CSRF cookie because all CSRF attacks use the clients cookies for sending a request. They can't read the cookies or the site's response hence why people put CSRF tokens into the page on return – Sirens Oct 12 '17 at 3:23
1

It sounds like this might lead to a form of session fixation, possibly preventing the system from ever re-issuing a new token by always making sure the cookie has one. The exploit vector for this might be a MiTM attack. Nevertheless, double-submit cookies are already somewhat vulnerable to MiTM attacks if not done properly.

Generally, with double-submitted cookies you don't need to change the cookie token for each request, just once per session.

If you need more strict protection, have long-lasting sessions, or multiple distinct sessions, you should look at using the synchronizer pattern.

  • Thanks for the answer, cookie is session-cookie, so it should not be fixed for all too long. – Ilya Chernomordik Oct 12 '17 at 6:43
  • @IlyaChernomordik And that is why many people recommend against double submit cookies, because people often make it less secure than it should be. You should have your session cookie marked HttpOnly and use a separate cookie for CSRF. – AndrolGenhald Oct 12 '17 at 13:06
  • I probably wrote it a bit misleading, it is a separate cookie that has session duration (dies when browser is closed). It is a separate cookie – Ilya Chernomordik Oct 12 '17 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.