0

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app).

The 'secondary' app that lives under a path consumes REST APIs from the 'main' app on the domain with a javascript single-page application.

We don't currently have OAuth or anything 'proper' set up to protect those endpoints. They use the same cookie to determine who the user is, but CSRF is still an issue (we're not in prod with it yet).

Can I safely request server to server a CSRF token from the 'main' Rails app and provide that to my secondary single page app to send along with each request?

It seems safe and secure to me until we're able to implement OAuth or similar, but I'm not a security expert by any means.

example.com => provides API, app #1 example.com/special_path => routes to app #2, consumes app #1's API, uses same cookie to auth

Improve this question

1 Answer 1

Reset to default
1

Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token.

As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.

Improve this answer
1
  • Aha; that reveals the problem with this strategy I guess: Rails creates a new one on every page load. So if a user: visits my site (gets CSRF #1), and in another tab opens the main site (gets CSRF #2) then #1 is no longer associated with the user. I'll do a cursory check in to delaying regenerating the CSRF token until a new session is created, but it seems like I'll lean towards something like JWT.
    – Alex Mcp
    Commented Aug 17, 2015 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .