I'm building a CSRF prevention method in our application framework. I use, inter alia, the OWASP site.
We have chosen for the "Double Submit Cookies" prevention meassure, described at the OWASP CSRF cheat sheet
The cheat sheet states:
When a user authenticates to a site, the site should generate a (cryptographically strong) pseudorandom value...
It sound like an user must log in first, before generating the CSRF token (aka "(cryptographically strong) pseudorandom value").
But how do I protect the forms who are accessible without authentication? Think about "forgotten password" and the login form.
I think the text should be "When a user enters a site, the site should generate a (cryptographically strong) pseudorandom value..."
This is also easier to implement, as I did on the following way:
- Application retrieves GET request: generate CSRF (session) cookie (if cookie isn't already in request)
- (else) Application retrieves non-GET (POST, PUT etc) request: validate CSRF cookie with CSRF token in request.
Am I missing a important aspect here?