A penetration testing is ordered on one of the web sites. I have implemented OWASP CSRF Guard on the web site. It uses custom headers for CSRF protection for AJAX. This got flagged with subject message. No explanation is given. I am not sure if the above statement is true. Why does it invalidate?
Please note that the presence of the CSRF token in the HTTP header invalidates the CSRF protection.
The OWASP Csrf Guard adds to ajax requests a custom header, "you specify the name". So the http header for my ajax call looks like "csrftoken: 4949-2393-....." This token then gets checked by the filter.
He's saying that this is not an enough protection and an attacker can access the custom http header and value. I did not think this was doable using GET or ajax calls. Assuming the attacker knows the header, (registered on the site), how can he determine the value of the token?
I don't get it.