4

When would it make more sense to:

  1. check the origin header
  2. use a CSRF token (in double submission or something)
  3. Use the SameSite cookie directive

for CSRF defense. Checking the origin header seems like it offers the most versatility over the other two, so I'm not sure why I'd want to use the other two unless I don't trust the browser to enforce the origin due to a flash bug or something (in which case I'd use the CSRF token).

Improve this question

1 Answer 1

Reset to default
4

OWASP has a great set of recommendations for dealing with CSRF:

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

You can use only an Origin and Referer check for CSRF protection without any other measures, if in the rare case that you receive neither header, you simply block the request. It was common once for users to spoof or disable the sending of Referer headers for privacy reasons, and older browsers may not send the Origin header. This probably doesn't really matter in 2017, but it depends on your needs.

You need to be able to extract the relevant info of the origin (eg hostname) from either header (which can include a full Referer header) and compare it with your target origin in a robust way.

I feel that a double-submit cookie (eg randomly generated token and cookie each time) may be simpler to implement.

Improve this answer
2
  • 1
    Huh, I thought the origin header check would be easier to implement as there's just one place in code to do the check (a Java filter or some equivalent) whereas double submission would require coordination between front-end and back-end engineers.
    – winhowes
    Commented Jan 15, 2018 at 1:20
  • 1
    The origin check needs to be able to parse a "Referer" header if the Origin header doesn't exist and you'd need to be able to extract the hostname from a URL in that field, so not overly complex but more complex than the cookie check which just needs to compare two strings. I guess it depends on how easy it is to add the token to all forms using whatever system you're using.
    – thomasrutter
    Commented Jan 15, 2018 at 1:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .