I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the backend is stateless, we want to implement double submit tokens. To avoid having to customize every single form in the frontend, we want the token to be submitted as a header instead of a hidden field. We wonder if it makes a difference if the token is generated in the backend or in the frontend.
Right now, we have configured axios to create a new UUID when the application is initialized in the browser. This UUID will be set as a cookies value as well as custom header.
Please note we know all our clients will be "modern" to some extent, so issues with legacy browsers like IE10 are not relevant to us.
We are aware that this mechanism would of course be rendered completely ineffective by an XSS vulnerability.
I have the following understanding:
- By using the jwt in the header, there is technically already a protection against csrf (according to this answer). Thus, the implementation of the double submit token is only done to satisfy the requirement, but adds no extra security
- If the double submit token is transmitted via the cookie and the header, it is irrelevant whether the token is created in the client (browser) or in the backend. For the sake of completeness: we use
Are those statements correct?