On the Angular single-page application (Angular + REST API) I use JWT authentication. Let's assume JWT tokens are properly generated and really random (you can't predict it).

Is this JWT token enough protection against Cross Site Request Forgery (CSRF)? In the other words, is JWT sufficient as anti-CSRF token as well?

  • 4
    If it's JWT in an authoriation header then yes, that prevents CSRF. If it's JWT in a cookie it doesn't – paj28 Jan 9 '18 at 10:37
  • @paj28 JWT usually is not a cookie, but I just wanted to check my understading of the issue with the community. – boleslaw.smialy Jan 9 '18 at 11:08
  • 2
    CSRF protection relies on the page sending something that content on the page can access but that external triggers cannot. It's more about how it's transmitted vs. the content (as @paj28 noted). If the CSRF token is in a cookie, that's bad, because the token will be sent automatically because of the cookie domain policy. You gain something by using a signed blob, but only if you do the much more important things around how CSRF protections work. – Joe Jan 9 '18 at 12:29

If the JWT is in a header, you should be safe. The attacker can't fool the victims browser into setting the header (unless CORS allow it, or she leverages an old Flash exploit). But lets say the attacker can control the header. Then what should she set it to? She wouldn't know.

On the other hand, if the JWT is in a cookie you will be just as vulnerable as with an ordinary session cookie. So wheater you are vulnerable or not has little to do with what kind of token you use (JWT or session ID) but more to do with where you put it (header or cookie).

Even when the authentication comes with automagic CSRF protection, you may want to consider adding a explicit CSRF protection anyway. There is always a risk that someone changes the authentication mechanism without realising it has double purposes.

| improve this answer | |
  • Thanks a lot for the reply. My assumption is that the JWT token is not a cookie and by using it via headers I could consider it as an anti-CSRF protection. – boleslaw.smialy Jan 10 '18 at 10:03
  • 1
    Yes, you could. – Anders Jan 10 '18 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.