Considering the following facts, using
CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable:
local storage(any where other than
http-only cookie) makes the API vulnerable to
- storing jwt in
http-only cookiemakes the API vulnerable to
So in order to make the API secure against, both
CSRF token must be implemented in the system. My question is how?
- Should I define a route like
/api/csrfso that the client is forced to send a request (containing their
http-only cookie, which holds their JWT) to that endpoint, before each POST/PATCH request, to get a
CSRF tokenand attach the token to the aforementioned POST/PATCH requests?
- Considering that there are no sessions, In server-side, Should I store the mapping to CSRF and user id(JWT) in database/redis?
Are the abovementioned solutions valid and secure? Are there any standard way to deal with this problem?
Authorizationheader, at which point neither attack should be a problem.