handle user-session-cookie and csrf token correctly for javascript app

Question

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax.

They are under the same domain but in different ports.
server api ---- www.example.com:9000/api/endpoints
web app ---- www.example.com:9001

Now, we save two types of cookies.
user-session-cookie # authenticate the user. secure = True, http = True
csrftoken # secure = True

I wonder in general, is this implementation secure? In what circumstance the site is not secure?

I don't mark csrftoken http = True because the javascript app need get the csrftoken to send requests. However, I am exposing the csrftoken to an XSS attack. Is there anyway I can prevent csrftoekn from XSS attack?

Answer 1

XSS and CSRF have a rock/paper/scissors interaction. XSS is always dominant over CSRF, and almost all methods on the CSRF Prevention Cheat Sheet can be bypassed with XSS. A case where XSS and CSRF cannot be used to trigger a request is if the request requires the current password, a token texted or emailed to the user, or another value that cannot be obtained using a browser with the constraints of the SOP. The Sammy MySpace Worm is a good example of how a CSRF sync token can be undermined using an XHMLHttpRequest().

XSS is a serious problem. A strong method of defending against XSS is defining a Content-Security Policy(CSP) rule set that prevents injected HTML from executing JavaScript. The CSP along with strong input validation can be used to prevent all XSS within an application with a high degree of certainty.