2

I know there are multiple places to put a csrf token and the most common one is to put in a hidden input field in a form. Second is in a cookie with the httpOnly flag. What I want to know is, is there an opposition to placing it in a javascript variable so that it can be used every time a post request is made to change data.

Otherwise you have to place it in a form’s hidden field for every form and it could be a problem if the form is dynamically generated.

1 Answer 1

3

You can dynamically add the CSRF token to forms via JavaScript. But you need to be aware of a couple of issues:

  • If you have cross domain forms you need to be careful that your JavaScript code doesn't add CSRF tokens to them, as it would leak the token.
  • If your application requires users without the highest level of privilege to create forms, then they can perform CSRF attacks as tokens will automatically be added.
  • HTML injection will lead to CSRF via injection of a form, which increases the impact of HTML injection a bit. In the same manner, if you allow a subset of HTML for some users, and your filter has a vulnerability that allows creation of forms, you will be vulnerable to CSRF.

Unrelated: CSRF tokens always need to be in two places; the most common approach is storing them server-side in the session and additionally in another place (eg submitting them in a form). That seems to be what you are referring to in your question. With this approach, storing the token in a cookie instead of a form will not work (it will always be submitted and will validate against the server-side token). Storing the token in a cookie would be used in place of storing it server-side. You still need to submit it eg via the form.

6
  • Thanks for the information, I couldn’t figure what the flaws might be.
    – Nathan
    Aug 1, 2018 at 9:02
  • As for your point 2, would it really matter if the non privileged user was able to post information to the server? Wouldn’t the server be able to determine the privilege level of the user and reject the posted data if it was insufficient? It is not like he is masquerading as a privileged user right?
    – Nathan
    Aug 1, 2018 at 9:11
  • @Nathan I meant a scenario where you want a less-privileged user to be allowed to post forms (eg a site moderator, but not administrator). That user could create a malicious form which, when submitted by an administrator, could perform arbitrary actions in the name of the administrator. So the user who creates the form would not be the one to submit it. Instead, the hope of the attacker would be that a higher-privileged user submits it (the form would of course not say "this is a malicious action"; it would purport to do something useful).
    – tim
    Aug 1, 2018 at 9:18
  • 1
    @tim For point 2 are you talking about a moderator creating a new form for the application? If so your wording is confusing, "privilege to post forms" makes me think they're just making a POST request with an existing form, not making a new form with arbitrary fields that could later be filled out by an admin. Aug 1, 2018 at 14:24
  • @AndrolGenhald Thanks, I edited the answer to be clearer. And there wouldn't necessarily be the need to fill anything out. The desired values would be preset via hidden input. The visible form could be a simple button.
    – tim
    Aug 1, 2018 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .