I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax.

They are under the same domain but in different ports.
server api ---- www.example.com:9000/api/endpoints
web app ---- www.example.com:9001

Now, we save two types of cookies.
user-session-cookie # authenticate the user. secure = True, http = True
csrftoken # secure = True

I wonder in general, is this implementation secure? In what circumstance the site is not secure?

I don't mark csrftoken http = True because the javascript app need get the csrftoken to send requests. However, I am exposing the csrftoken to an XSS attack. Is there anyway I can prevent csrftoekn from XSS attack?

1 Answer 1


XSS and CSRF have a rock/paper/scissors interaction. XSS is always dominant over CSRF, and almost all methods on the CSRF Prevention Cheat Sheet can be bypassed with XSS. A case where XSS and CSRF cannot be used to trigger a request is if the request requires the current password, a token texted or emailed to the user, or another value that cannot be obtained using a browser with the constraints of the SOP. The Sammy MySpace Worm is a good example of how a CSRF sync token can be undermined using an XHMLHttpRequest().

XSS is a serious problem. A strong method of defending against XSS is defining a Content-Security Policy(CSP) rule set that prevents injected HTML from executing JavaScript. The CSP along with strong input validation can be used to prevent all XSS within an application with a high degree of certainty.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.