I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over that user up to their given permissions. The request to generate the api-token is made via an AJAX GET request on the same domain.

By default CORS is blocking cross site requests. I've read that I shouldn't rely on CORS only for CSRF protection. But CSRF protection mechanisms don't seem to apply here because it's a GET request providing the sensitive data.

So, if an attacker obtains another users cookie (ie: XSS from another domain to get at a users cookie) and I want to prevent them from being able to retrieve that person's api-token using said stolen cookie. What are my options? Are there additional precautions I should be taking to protect this api-token given it's authentication mechanism?

  • You are touching on two separate topics here. First, CSRF: This is not an issue, since in a CSRF attack the attacker cant read the response. – Anders Mar 15 '18 at 0:33
  • Second, how to protect against stolen session ids. This is the same as it would be for any app that uses sessions. The fact that its giving you an API token is irrelevant. – Anders Mar 15 '18 at 0:34
  • Fair enough, I'm just talking through it since this is mostly new to me. I'll read up on Session Management best practices if that sounds like the main concern here. – mjmj Mar 15 '18 at 3:13
  • Yeah, I think that is the right area to go into. :-) – Anders Mar 15 '18 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.