Is it safe to build an API to provide CSRF one-time use token to avoid CSRF attack? Will this open a new vulnerability?
I have one more doubt regarding the traditional approach of including CSRF. I wonder that providing the csrf token in the form can be scraped and attack may be implemented by the attacker. Please correct me if my thought process in incorrect.
Is API for CSRF token safe?
Viewed 27
1 Answers
First of all you need to understand how a CSRF attack looks like. Someone can send you a link to http://malicious.com/whatever.html. You open this site and there will be an invisible form, that will send a POST request to http://example.com/account/1/delete. You will be logged into example.com on some other tab, so assuming the session is handled via a cookie, the cookie gets automatically attached and you execute a request you never intended to and are even unaware of.
We can mitigate the CSRF issue via different means, on of the being anti-CSRF tokens. The idea is that there is some kind of secret malicious.com will be unaware of and that can not easily be guessed. Please note, that in the CSRF scenario your means of attack are making people open some link. You have no access to the content of what they are seeing. You just send them a link and expect some requested to be executed with their access rights.
Related