I have a server domain
server.com and a UI app at
server.com domain handles user auth and sets a session cookie under the
server.com domain. It also has a rest-like endpoint that serves GET requests at
/user_data and returns sensitive user data to users with a valid session. The 3rd party UI at
client.com needs access to the user_data in an AJAX call, so
CORS is enabled at the
/user_data endpoint for the origin domain
The endpoint in question has no side effects, although it serves sensitive data to a 3rd party. Do I need to implement some CSRF token protection for the endpoint? Could the user_data be read by a compromised
client.com webpage (via persistent XSS)? If so, can I use a query param mechanism of
CSRF token exchange? The way I understand it, it's the only option, because the
client.com cannot read csrf tokens stored in a
server.com cookies. However OWASP guidelines state that:
Make sure that the token is not leaked in the server logs, or in the URL.
If that's also a problem, how can I secure my application?