Skip to main content
298 votes
Accepted

Should I use CSRF protection on Rest API endpoints?

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
Conor Mancone's user avatar
122 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
Conor Mancone's user avatar
98 votes
Accepted

Does a CSRF cookie need to be HttpOnly?

As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation: If you enable this and need to send the value of the CSRF ...
Anders's user avatar
  • 65.7k
78 votes
Accepted

For SameSite cookie with subdomains what are considered the same site?

The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com. This means that a requests from login.mysite.com to cdn.mysite.com would be ...
ilikebeets's user avatar
  • 2,916
66 votes
Accepted

Difference between XSS and CSRF?

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your ...
Arminius's user avatar
  • 45k
66 votes
Accepted

Why don't browsers block cross-site POSTs by default?

In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities ...
Anders's user avatar
  • 65.7k
48 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
ndrix's user avatar
  • 3,306
46 votes

Pentest Results: Questionable CSRF Attack

This does not seem to be a CSRF vulnerability. If an attacker needs to know a CSRF Token, then it's not an attack. And your approach to CSRf does seem to be correct. Issues which leak the CSRF ...
tim's user avatar
  • 29.7k
40 votes
Accepted

HTML login form without a CSRF protection

This is called "Login CSRF" and is indeed a real problem that you should address. While an attacker couldn't fool a victim to log in to their own account since the attacker doesn't know the ...
Anders's user avatar
  • 65.7k
39 votes

How does CSRF correlate with Same Origin Policy

Let us start by defining the term "origin". The origin of a page is decided by three unique factors: hostname, protocol and port number. For example, http://test.com and https://test.com have ...
Shurmajee's user avatar
  • 7,487
36 votes
Accepted

Is checking the Referer and Origin headers enough to prevent CSRF, provided that requests with neither are rejected?

Expanding on the answers of @Sjoerd and @lindon. Origin vs Referer vs CSRF token Most likely, the reason OWASP recommends also using a CSRF token, is that at the time when this recommendation was ...
Tobias Bergkvist's user avatar
34 votes
Accepted

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute? In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
Arminius's user avatar
  • 45k
29 votes

Is a JWT usable as a CSRF token?

TL;DR A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (...
Scott Jungwirth's user avatar
27 votes
Accepted

Why is CSRF protection only applicable to web services with browser clients?

It comes down to the fact that CSRF is an attack against browsers, so if your service is exclusively used by non-browsers there's no point in using anti-CSRF defences, which can be expensive so may be ...
Douglas Leeder's user avatar
25 votes

Do I need CSRF token if I'm using Bearer JWT?

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
Daniel Szpisjak's user avatar
24 votes

Why don't browsers block cross-site POSTs by default?

The problem is not the request method: CSRF could also be done with a GET request. The problem is instead that authentication information like (session) cookies or the Authorization header are ...
Steffen Ullrich's user avatar
23 votes
Accepted

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

Your understanding is correct. Background The simplest way to think of a CSRF attack is that your browser has two tabs open - Tab A: www.mybank.com and Tab B: www.attacker.com. (As @Alex points ...
Mike Ounsworth's user avatar
20 votes
Accepted

How do I safely host third-party Javascript code in an iframe?

If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...
Ajedi32's user avatar
  • 4,803
19 votes

For SameSite cookie with subdomains what are considered the same site?

Let me explain the specification. The definition of "same-site" is : A request is "same-site" if its target's URI's origin's registered domain is an exact match for the request's ...
xianshenglu's user avatar
18 votes

Does a CSRF cookie need to be HttpOnly?

I think the main point of confusion here is that the Django docs are specifically talking about the CSRF use case for a cookie. In order to understand why the httpOnly flag adds no value in preventing ...
colllin's user avatar
  • 281
18 votes
Accepted

Do I still need CSRF protection when SameSite is set to Lax?

The current answer shows that we currently should not. But at what point in the future can we start to rely on this? Comparing the data from caniuse and the MDN support tables. You can observe that ...
anthonyryan1's user avatar
18 votes
Accepted

Is a backend API server vulnerable to CSRF?

Our application is a pure backend server. Serving JSON APIs to the users. Users will be calling these APIs from their backend in 99.99% of the cases. ... It does not matter what the API is serving or ...
Steffen Ullrich's user avatar
17 votes
Accepted

Current status of SameSite cookie

SameSite cookies are here to stay. They were available for a long time in Chrome (since v51) and more recently got implemented in Firefox. Making cookies samesite protect against a whole range of ...
Sjoerd's user avatar
  • 31.8k
16 votes

Securely using JWTs with CSRF protection and refresh tokens

You seem to be mixing up several different opposing technologies, and do not make it clear why you have chosen these technologies and why they control the threats you are trying to secure against. ...
SilverlightFox's user avatar
15 votes

Should I use CSRF protection on Rest API endpoints?

Whether or not CSRF protection is needed is based on 2 factors: - Is the request doing a state changing action (not the same as REST API Statelessness) - State changing actions are any action that ...
an0904's user avatar
  • 313
14 votes
Accepted

Will "Authorization: Bearer" in request header fix CSRF attacks?

Would this approach actually work to prevent CSRF attacks? Yes. An attacker can't make a browser send a request that includes the authorization header with the correct bearer token. This is for two ...
Anders's user avatar
  • 65.7k
14 votes

Does a CSRF cookie need to be HttpOnly?

That is correct. This is a false positive and the person providing this finding to you does not understand what they are doing unfortunately. Someone that understood the risks of mitm and csrf attacks ...
joe's user avatar
  • 602
14 votes
Accepted

Is the double submit cookie pattern still effective?

Double-submit cookies was always a relatively weak CSRF protection, at least as typically implemented. Any attacker who can set a cookie - either via a cookie injection vulnerability in the app or via ...
CBHacking's user avatar
  • 49.6k
13 votes
Accepted

How does sending referrer HTTP headers protect against CSRF attacks?

To understand this, one first needs to understand what a cross-site request forgery is. A Cross-Site Request Forgery is when the attacker has some script or embedded media on a website they control ...
Philipp's user avatar
  • 49.5k
13 votes

Should I use CSRF protection on Rest API endpoints?

"there is no way for a browser to automatically provide authentication credentials even if it is somehow tricked into visiting the API endpoint" Just be careful on private networks using ...
stuartm9999's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible