tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie immediately considered a valid alternative?
I am trying to find a way to mitigate CSRF in a cross domain scenario where the client stores all the static assets (including the index.html entry point) and the server is in a completely different domain (no shared parent domain).
I was looking at first at the Cookie to Header Token method, but it seems that both the client and the server must be on the same origin.
However, it seems that for cross origin domains, this won't work.
XHR can't access the
Set-Cookieheader. XHR doesn't allow looking at response cookies. Even with the most permissive CORS headers, and even if not set as httpOnly, it's blocked by the browser. (It will also hide the Set-Cookie header if looking in dev tools) (https://fetch.spec.whatwg.org/#forbidden-response-header-name)
Setting the Cookie Domain to that of the XHR's Origin doesn't work. What if the server will set the cookie to the client domain? It is impossible to set a cookie for a different domain of course, (https://tools.ietf.org/html/rfc6265#section-22.214.171.124) and this includes XHR, e.g. if I have XHR in page
ui.example.commake a request to a server in
api.example.net, and the server sets a cookie with domain
ui.example.com, the user agent seems to reject the cookie from what I've seen, (I assume since the server and the page itself are still in different origins), although the XHR
Originis the same as the
Domainthat was set in the cookie, this won't work, and I'm sure there are good reasons for it.
Are any of my assumptions above incorrect?
Is there any authoritative source that defines the alternative approach above as secure? Does it have significant disadvantages over the same-domain cookie-to-header-token method?
Are there any other ways to securely mitigate CSRF for this use case?
Related Answers I Reviewed
I went through the following questions / answers but none of them felt like an authoritative answer to my question, I may have missed to read between the lines so my apologies if this is an exact duplicate