I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks. He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible. Say a request to update your account info looks something like this:

POST /ajax/account/savebasic HTTP/1.1
Host: www.mysite.com
Connection: keep-alive
Content-Length: 72
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://www.mysite.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.65 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: https://www.mysite.com/portal
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: X-Mapping-fjhppofk=B8BFE26CD0B3A37348ECC6FFE3940306; sdemail_5228=tester%40test.com; sd_5228=%7B%7D; connect.sid=s%3AAQIPx7hyddXEYTOuyP857jEG.D002GI6%2FSEF0m5WTBUxRmbjpE48%2BMkPxEe9o2T9DH1Y; __utma=160595647.1524201255.1358783236.1379476052.1379533347.150; __utmb=160595647.1.10.1379533347; __utmc=160595647; __utmz=160595647.1376327581.102.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=http://mysite.com/


I created a test HTML page on testdomain.com like the one below:

    <title>Bad site</title>
    <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script>
    <div id="main">Hey!</div>
    <script type="text/javascript">
    type: "POST",
    url: "http://www.mysite.com/ajax/account/savebasic",
    data: { 
        "fname": "CSRF",
    dataType: "jsonp"

Thinking that it would overwrite everything, but it redirects a few times and eventually throws a 404 error. Is my coworker correct in saying that we are safe from CSRF because we use AJAX/REST?

2 Answers 2


Same-origin policy doesn't allow to JavaScript or similar receive response of sent requests outside your host !

In computing, the same-origin policy is an important security concept for a number of browser-side programming languages, such as JavaScript. The policy permits scripts running on pages originating from the same site – a combination of scheme, hostname, and port number1 – to access each other's methods and properties with no specific restrictions, but prevents access to most methods and properties across pages on different sites.1 Same-origin policy also applies to XMLHttpRequest and to robots.txt.

Your application is Ajax but it can be vulnerable to CSRF (if you don't check content-type or adding unsafe Same-origin policies).

If you don't check content-type, attacker can send this request with normal form, like this :

<form name="x" action="http://site/index" enctype="text/plain" method="post">
  <input type="hidden" name='{"fname":"abe","lname":"m","company":"comp","email":"abe@test.com","Junk":"' value='Noting"}'>
  • There it is! Awesome thank you! One weird thing is that it's clearning out all of the values that should be updated. So instead of CSRF for all values I'm getting empty strings. Any idea why that would happen? I looked at the request payload and it looks correct... Sep 18, 2013 at 21:23
  • 1
    @AbeMiessler : Please check: is your application sensetive to X-Requested-With or Content-Type or Referer header ? Sep 18, 2013 at 21:39
  • Hrrm, I'm not sure. How would I check that? Sep 19, 2013 at 14:46
  • 1
    With using proxies and manipulating request data like Zed Attack Proxy (ZAP) , BurpSuite and ... . Sep 21, 2013 at 6:54
  • @Sajjad, I would agree with most of what you said, but the first line - "up Same-origin policy don't allow to javascript or similar send requests outsite your host !" Actually, AFAIK, SOP will still send requests. It only prevents access to the returned response cross domain.
    – qre0ct
    Feb 17, 2016 at 6:50

The simple answer is no, RESTful sites are not "inherently" safe against CSRF attacks. There is nothing about being RESTful that prevents CSRF because CSRF doesn't require REST to work. Think about session fixation, which can be one form of CSRF. If I can fix your session ID then I can begin executing requests as you, RESTful or not. Also, don't be confused either by the first part of CSRF and XSS (cross-site) because an attack does not need to occur from one primary domain to another in order to be CSRF or XSS. It is a bit of a misnomer that confuses people when trying to protect against these types of attacks. Just because you don't rely on the referer or you set a strict same domain origin policy doesn't mean you still aren't vulnerable to CSRF.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.