0

I'm implementing CSRF guard in my web application. I have done all the required configuration and I can see token getting generated/injected into the request header.

Let me tell you application's architecture a bit, I have JSP pages which makes call to services using Ajax to get the data and display in the UI.

My question here is "Can we protect service calls also with CSRF guard?" If it is possible then how can I do this because it is not going to CsrfGuardFilter.java class when I'm debugging the execution.

1
  • 1
    Remote services would need CSRF guard as well and even if they had it, how would the services know if a generated token is valid? You have to think of a service as a separate application and CSRF guard works within one application.
    – mcgyver5
    Commented Dec 16, 2014 at 17:11

1 Answer 1

1

When you want one applicaton to prove that it has the right to talk to another (the web service) we are no longer talking about CSRF but about authentication. Usually this is done by secure token sent from web application to web service via a POST request.

Check out the first answer to this https://stackoverflow.com/questions/6134082/restful-web-service-how-to-authenticate-requests-from-other-services

and

https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .