A site I work on has a link that downloads and opens a PDF containing sensitive user data. The user's authentication cookie is checked serverside to ensure they have access to the data before generating and serving the PDF. However, I worried about the prospect of data being leaked by a CSRF attack. Because the PDF is opened by the user clicking an ordinary
<a> link, most CSRF defences are not viable or incur security or UX tradeoffs. For example:
- Adding any kind of token to the link URL would make the URL less readable and user-friendly
Am I right to be worried about CSRF in this scenario, or is the same origin policy sufficient to let me just rely on cookie authentication for this endpoint without fear of leaking user data? The kind of attack I'm envisaging is one like the famous Gmail CSRF flaw that leaked your contacts list - I'm concerned that by provoking the download in a way that triggers some side effect in the browser, an attack site could make inferences about the content of the PDF, although I have no idea what the precise mechanism of such an attack would be.