CSRF Token for Anti Automation for multiple requests

Question

Need some inputs for the CSRF token design to prevent anti-automation.

1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part of the Get Response of Page Load.

   The idea is to provide a solution, where no major state is stored on the server-except for one token for each user session per request.

   Everytime a request is made (GET/POST), the existing token is validate and a new token is returned from the server to the client. This is stored in the user session.

   On sending the POST request, client validates whether the token value is equal to value in the session and server validates, whether the token received in the request is same as the token stored in the session.

2. When the user performs an action, there can be multiple requests to the server at a point of time from the client side. Or before the earlier request's response is received, there can be another request send from the client application.

   In this case , would the same CSRF token be send? Or should a pool of tokens be returned from the server for the same?

3. Can this token's also be used for GET requests so as to prevent the attacker to not clog the server with replay attacks with the GET requests?

4. Also, should the CSRF token send in the header or body?

5. Is there any need for it to be encrypted?

Answer 1

Generally CSRF-Token is used only when the state change request is made by user. State change means when user perform some CURD Operation on Application.

It’s not required to gives bunch of CSRF-token to every form in multistage form. But generally Programmer gives to every single form. Whether that Form is contain any state change action or not

We generally not recommended to use CSRF-token in get request because of GET request logged at multiple places (Logs, Load-Balancer etc.) so it creates risk for your Application .

Questions:

For Updating operation, there are multiple requests send to different modules on the Server. should the CSRF be same or different?

You can use the same CSRF-token issue one token for each user-session. If your application is perform critical operation than you can go for one token for each form.

Before a response is received, the screen is allowing user to initiate one more request? what should the CSRF token be send? The assumption is that, once the CSRF token is validated, then a new token is generated and send in the response.

If your application uses the multiple token for a single form of action, then you need to validated that token in each request and in response new token will be given to the user. But generally we haven't recommended these kind of complex implementation. if it is not that much critical application

CSRF should be send in header or body? Should It be encrypted?

Always in the body not in cookie. There is no need to do encryption on CSRF-Token. It is nothing but a Secure random generated string for validating that the action is intended by that user or not.

For more details, read the OWASP CSRF Prevention Cheat Sheet.