I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my API server on a different domain. The API CORS policy is whitelisted to accept requests from the js application.

Is the CSRF token requested via ajax secure? Can't the origin headers be spoofed by anyone who wants to obtain a valid CSRF token? (The token is generated by Laravel)

  • CSRF tokens need to be bound to a session ID to prevent such abuse. – nbering Aug 28 '18 at 0:46
  • Care to explain more?? I don't quite understand. – zeros-and-ones Aug 28 '18 at 3:38
  • I’m not sure I can do the topic justice on my own, because there are a lot of pieces at play in a CSRF token scheme (which is why I didn’t give a full answer). But basically anyone could get a valid token. But the token is paired with a session key, and the combination of TLS and browser security features help protect that. An attacker can’t fake origin in the browser, either. Only in crafted requests. So they could make a bogus request with a form but wouldn’t have a valid token for the session. Same origin policy would block AJAX from attacker’s JS. – nbering Aug 28 '18 at 3:53
  • Thanks! It seems that since I am using a JWT based authentication I am OK? Where I am now is that the authentication is lost if an user refreshes the page. Is it safe to store the JWToken in local storage? – zeros-and-ones Aug 28 '18 at 4:15
  • 1
    Local Storage is generally OK, since it’s keyed to the domain that the code loaded from (similar to cookies, but without sending them automatically on every request). – nbering Aug 28 '18 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.