2

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host header?

I'm asking because I'm trying to make my application ready for proxies. Load balancers on public networks are one of the many possible use cases, but local SSL/TLS wrapper is more urgent as we need to test WebCrypto API usages in secure contexts.

Improve this question

1 Answer 1

Reset to default
1

According to OWASP Cheatsheets, both are fine. I would object checking X-Forwarded-Host, as it's not a forbidden header.

You can do the following check, and it will be compatible in most cases: ( $Origin or $Referer ) == ( $Host or %ServerName% )

As for the load balancer part, if you're considering deploying a commercial CDN for your application, the following configuration may be usable (it's based on Apache HTTPD, other servers would have different config directives):

UseCanonicalName on
<VirtualHost *:*>
  ServerName app01.example.com
  ServerAlias app01.source.example.com
  ...
</VirtualHost *:*>
...

And configure the DNS servers to resolve app01.example.com to the CDN, and point the CDN to app01.source.example.com. This way, when an HTTP request arrives at your server, Origin/Referer will match ServerName in your server-side CSRF defense codes.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .