I'm trying to figure out if I completely understand CSRF security properly. Based on:


In all scenarios it seems like your frontend has to have the CSRF token somewhere so that when a request is sent to the backend, it can compare both the csrf token in the cookie/session to the request. That way when an attacker tries to create a request on behalf of a logged in user, since they don't have the token in the request, it won't be validated.

This means in order for CSRF implementation you need to configure both front and backend.

Now let's say I want all the CSRF security to be done on the backend is this possible, not changing frontend?

Also if my frontend application is separated from backend, do I still need to be worried about CSRF attacks?

  • CSRF is a browser (aka front end) related security concern, so it is not possible to secure against it exclusively from the backend. – Conor Mancone Sep 28 at 18:57

Yes, one method of ensuring CSRF protection is to check the Origin and Referrer headers to see whether they match the expected origin, as these headers cannot be overwritten by any frontend code. However, the origin header is only sent on POST or CORS requests, and the browser implementations of these headers have historically not been consistent; e.g. possibly allowing JavaScript to spoof one or more of the headers (modern browsers should behave correctly, although I cannot speak for the future spec or implementation).

This protection only requires implementing a server-side check on every POST request. It is important to deny the request if the sent origin doesn't match, or if none was sent at all.

The OWASP CSRF Cheat Sheet includes some reasons for why you may not want to use this method exclusively. However, if you face none of those restrictions, I personally feel that this method is okay to use in lieu of a more complex method.

Also depending on browser support is the "SameSite: strict" cookie option. This prevents cookies from being sent at all from a 3rd party site, also mitigating CSRF.

| improve this answer | |
  • The trouble with that has historically been lack of support in older browsers, but those may have finally aged out... – Conor Mancone Sep 28 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.