I'm working on a RESTful API to work with my AngularJS application.
Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using
FormsAuthentication.Encrypt. This approach could result in the authentication cookie being stolen, however that problem is out of scope for this question.
The question is about generating an CSRF token. I want to generate the token based on the authentication cookie, that way when the user logs out (or logs out and back in) the token will be invalidated. Problem with generating a token for each form is that then the form could expire before the authentication expires. I want forms to remain valid for as long as the user is logged in.
If the authentication cookie is hijacked, all security is lost anyways. Because of that I don't see any added risk to the CSRF token relating to the authentication cookie. The token will be sent to the client as cookie, and to the server as header.
Additionally I'll check referer/origin headers, but that's out of the scope for this question.
# URL that doesn't require authentication
GET /api/security/session HTTP/1.1
HTTP/1.1 200 OK
Set-Cookie: .ASPXAUTH=SomeLongHexCodeHere; Expires=...; HttpOnly
Set-Cookie: CSRF-Token=TheToken; Expires=...;
# URL that does require authentication
For generating the CSRF Token I was thinking about generating a salted hash from the .ASPXAUTH cookie. Would this suffice in the protection against CSRF, assuming XSS is blocked and the authentication cookie isn't hijacked?
Two final notes. Although my code runs on the ASP.NET platform, it's not using any of the ASP.NET technologies (WebForms, WCF, MVC, WebAPI, etc.) and cannot use their CSRF protection methods. Secondly the site doesn't use SSL, and sadly won't use SSL. It'll be vulnerable to MITM attacks, and there's not too much I can do about it.