Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this:
- When a user logs in, the client sends a login request.
- Server sets a signed JWT token as a cookie with
- Server also sends a CSRF token without
- When the client makes any future requests, the JWT cookie will automatically be sent and the CSRF will have to be set in the request header. This should prevent CSRF attacks since the CSRF cookie will have to be read.
So in short we have:
Setting the JWT token with
;Secure;HttpOnlywill prevent XSS attacks.
Making the client set the CSRF cookie in the request header will prevent CSRF attacks.
But what if an attacker gets your CSRF token using XSS and sets it as a header for requests sent by a malicious website with a CSRF exploit. Is this attack possible? If so, how could I improve my authentication scheme?
Thanks in advance.