Search code examples
javascriptcsrfsame-origin-policy

CSRF protection for GET requests

I have a RESTful API that I interact with via a website I have made. I have POST, DELETE, PUT, etc. requests adequately protected, so attackers cannot make any changes to the database via CSRF.

However, if someone uses CSRF to make a GET request to the website, I'm worried that they may be able to view the response, which could reveal the sensitive data that is stored in the database.

Is it possible for them to view the response to a cross-site GET request, or is this definitely, completely taken care of by Javascript's Same Origin Policy?

Solution

  • is this definitely, completely taken care of by Javascript's Same Origin Policy?

    Yes. That's the point of the Same Origin Policy.

    To be vulnerable you would need to either:

    • Punch a hole in the SOP using something like JSONP or CORS or
    • Not perform user authentication so they could access the data without involving an authenticated user's browser as a middleman