I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate.
I'm trying to write a piece of code that automatically loads on different domain that'll sends a GET request to that endpoint, using that persons cookies to see if I can maliciously fetch their new api token. I'm just checking to see if my endpoint is safe or if this is possible. I only want logged-in requests from the same domain being able to hit that endpoint. Not sure if this is actually considered CSRF since there no state changing. There is a CORS policy so not sure if that is preventing me from doing this. And varnish is the front end with X-XSS-Protection:1 enabled.
Things I've tried, simply having a different domain page load the endpoint. With a user logged in another tab. This returns a 200, with expected cookies of the logged in user, but no the JSON response.
<img src="https://mydomain/endpoint" width="0" height="0" border="0">
The below returns a 200 with correct cookies of logged in user, but no json response. I believe this is not returning data due to same origin policy in the browser. Correct me if I'm wrong.
document.write('<img src="https://mydomain/endpoint?cookie=' + document.cookie + '" />')
Both XMLHttpRequest and JQuery to perform a GET request to the target endpoint, again from a different domain and user logged into on a different tab. Returns a 401 not authorized and no cookies. Maybe there's some additional jquery I need to capture and send cookies with the request.
$.get('https://mydomain/endpoint', function(responseText) {
alert(responseText);});
As well as copying the curl request from Chrome developer console of a successful web request to the api endpoint. Surprisingly curl doesn't return the new token even with the expected parameters & cookies. Maybe also because of same origin policies.
Other ideas, is this even possible with what I've described?