0

I'm implementing CSRF guard in my web application. I have done all the required configuration and I can see token getting generated/injected into the request header.

Let me tell you application's architecture a bit, I have JSP pages which makes call to services using Ajax to get the data and display in the UI.

My question here is "Can we protect service calls also with CSRF guard?" If it is possible then how can I do this because it is not going to CsrfGuardFilter.java class when I'm debugging the execution.

  • 1
    Remote services would need CSRF guard as well and even if they had it, how would the services know if a generated token is valid? You have to think of a service as a separate application and CSRF guard works within one application. – mcgyver5 Dec 16 '14 at 17:11
1

When you want one applicaton to prove that it has the right to talk to another (the web service) we are no longer talking about CSRF but about authentication. Usually this is done by secure token sent from web application to web service via a POST request.

Check out the first answer to this https://stackoverflow.com/questions/6134082/restful-web-service-how-to-authenticate-requests-from-other-services

and

https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.