CSRF testing of an api endpoint using GET requests

Question

I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate.

I'm trying to write a piece of code that automatically loads on different domain that'll sends a GET request to that endpoint, using that persons cookies to see if I can maliciously fetch their new api token. I'm just checking to see if my endpoint is safe or if this is possible. I only want logged-in requests from the same domain being able to hit that endpoint. Not sure if this is actually considered CSRF since there no state changing. There is a CORS policy so not sure if that is preventing me from doing this. And varnish is the front end with X-XSS-Protection:1 enabled.

Things I've tried, simply having a different domain page load the endpoint. With a user logged in another tab. This returns a 200, with expected cookies of the logged in user, but no the JSON response.

<img src="https://mydomain/endpoint" width="0" height="0" border="0">

The below returns a 200 with correct cookies of logged in user, but no json response. I believe this is not returning data due to same origin policy in the browser. Correct me if I'm wrong.

document.write('<img src="https://mydomain/endpoint?cookie=' + document.cookie + '" />')

Both XMLHttpRequest and JQuery to perform a GET request to the target endpoint, again from a different domain and user logged into on a different tab. Returns a 401 not authorized and no cookies. Maybe there's some additional jquery I need to capture and send cookies with the request.

$.get('https://mydomain/endpoint', function(responseText) {
alert(responseText);});

As well as copying the curl request from Chrome developer console of a successful web request to the api endpoint. Surprisingly curl doesn't return the new token even with the expected parameters & cookies. Maybe also because of same origin policies.

Other ideas, is this even possible with what I've described?

Answer 1

As you started to mention, CSRF is only really useful for actions that change state, so this is not truly an example of CSRF.

From OWASP:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.

Further, the reason you are not able to see the response is likely due to Cross-Origin Resource Sharing (CORS).

MDN web docs states:

For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts. For example, XMLHttpRequest and the Fetch API follow the same-origin policy. This means that a web application using those APIs can only request HTTP resources from the same domain the application was loaded from unless CORS headers are used.

So while the remote resources are indeed fetchable, the browser is disallowing the JavaScript on your test pages from viewing the responses. Note that is the default behavior unless you have gone out of your way to set the correct headers on the server.

Answer 2

As long as CORS is correctly configured, it is not possible to extract information from another domain via JavaScript.

You should also check that your JSON endpoints return an object, and not an array, to protect against JSON Hijacking, an old vulnerability affecting old browsers.