Is csrf protection required for extremely short lived cookies?

Question

I have an app with token-based authentication (stateless).

for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie.

so I creates a cookie with my access token, with 1 second lifetime , just for the use of this endpoint:

// Set one-time cookie only for this action
Cookie.set("token", token, {
  secure: true,
  expires: new Date(Date.now() + 1000), // one second lifetime
});

// Open url
const newTab = window.open(
  pdfURLForAuthenticatedUsers,
  "_blank"
);

Do I need to implement csrf protection in this case? or it is safe enough ?...

thanks!

Answer 1

CSRF requires user interaction to be exploited.

So unless you expect a user to access the attacker website within the 1 second period after executing your script, I wouldn't consider the likelihood of this attack very high.

So no, although CSRF is theoretically feasible, you can dismiss it with this justification.

On a side note, if there is another place in your code that sets the token cookie for a longer period, then you have a problem.

And in a more larger sense, you now have to be careful to not set this cookie anywhere in your code.