Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I came across boil down to sending a CSRF token in the headers, but most of them get this token from either HTML or a cookie that came with the GET request.
Now as my site is 100% Ajax and it doesn't reload. I wonder if I could, before each POST request, make a GET request to the server to get token and then submit it in the headers along with the POST request, for example
Submit GET request to
aaa.com/get-csrf-token to get the token and then submit that token along with the request in the headers, if someone from another site makes a GET request to
aaa.com/get-csrf-token and the server returns a token, then as far as I know they are still not able to read that value.
As the token is generated on a per session basis, I can simply check that the submitted token is the same token I have in the memchache which is associated with that session.
Could someone tell me if this would work?