This question already has an answer here:
I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such headers.
So I was assuming to recommend using Authorization: Bearer tokens for the ASP application I am currently testing. Since this this header value won't be sent by the browser itself, I am assuming this approach would fix CSRF issue. But then I came to notice a stack overflow question which confused me a little. The answer still recommends to use the CSRF tokens.
So, basically I have two questions.
- Would this approach actually work to prevent CSRF attacks?
- I know If I am vulnerable to XSS attacks my cookies can be read and the bearer tokens can be stolen. But can the injected XSS create a the Authorization: Bearer header and append the stolen value from cookie?