We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we have
Access-Control-Allow-Origin: * header set.
We have some API routes that do not require prior authentication such as
Every other API route requires an authentication token appended to it, for example
/important-action?authtoken=abc123. It does not accept cookies in headers or the body of requests. app.example.com saves the auth token in a cookie to preserve the session.
What I'm struggling to understand is how evil.com can exploit this setup- Can somebody please give some examples of how an attack could work or stop me worrying and let me know CSRF isn't an applicable risk.
I've read other answers that refer to "using cookies" but they do not clarify what exactly "using" means. In our case, we're storing the authtoken in a cookie and appending it to the request URL. The API ignores any cookies sent in the request header.