I have a web app in which, when users request a page, a
CSRF token is generated and injected into the
jsp page in a hidden
The same token is then sent to the server for every AJAX call in a custom header whereas, a session-state token is contained in a cookie (
Now, since the
CSRF token is something new in the webapp, if after the update the user was already logged in, and he sends a request, a
Filter will determine that he's in fact logged (because of session-state token in the cookie), but a valid
CSRF token is not contained in the custom header, and so the defined behavior is to log him out.
I may deal with this, by following this OWASP example.
CSRF token is not present, I intend to send a
NO-CONTENT request back and somehow provide the token.
Here's the first doubt:
Shouldn't the CSRF token not be placed in a cookie?.
Moreover they are providing a
CSRF token back if it's missing in the request, which seems to me a bit of
anti-secure: an attacker could have stolen the session token from the
cookie, send a request, and magically receive the
CSRF token back.
I therefore feel confused here.
- Should I just put the
CSRFtoken in the cookie along the session state token?
- Should I avoid providing a
CSRFtoken if none is set, but a session-state cookie exists?
- What may an alternative solution for my case be?
Before checking the CSRF token, I verify the
referer headers, as advised here.
I do not plan to implement a
use-only-one-per-request CSRF token.
Although irrelevant in this context, the communication happens via HTTPS