Search code examples
cookieshttpstokencsrfjwt

are CSRF attacks still possible when using a httpOnly+secure cookie with a token lifetime of 1 month?

I already worked with JWT on mobile app but I will implement it on a website for the first time for the authentication and I have a little thing I still didn't understood :

  • if I use JWT token with localStorage, XSS attacks are possible
  • if I use JWT token with cookies, CRSF attacks are possible

..., but if I use JWT token over HTTPS with httpOnly+secure cookies and a token lifetime of 1 month, are CSRF attacks still possible in this case ?

I see all over the web for custom token with cookie or custom token with localStorage or JWT but I didn't explicitly get the answer of httpOnly+secure cookie + JWT + HTTPS + the need of CSRF.

Solution

  • If you are using JWT as an authentication token, it should be stored as a cookie marked httpOnly and secure, as apposed to using Local/Session Storage. As you mention, this protects against XSS attacks, where we are concerned about malicious JavaScript being injected into our page and stealing our session token.

    • A cookie marked httpOnly cannot be read by JavaScript, so it cannot be stolen in an XSS attack.
    • Local/Session Storage, however, can be read by JavaScript, so putting the session token there would make it vulnerable to an XSS attack.

    However, making the session token cookie httpOnly and secure still leaves you vulnerable to CSRF attacks. To see why, remember that cookies are marked with the domain from which they originated, and the browser only sends cookies that match the domain to which the request is being sent (independent of the domain of the page the request was sent from). For example, suppose I'm signed into stackoverflow.com in one tab, and in another tab go to evil.com. If evil.com makes an ajax call to stackoverflow.com/delete-my-account, my stackoverflow authentication token cookie will be sent to the stackoverflow server. Unless that endpoint is protecting against CSRF, my account will be deleted.

    There are techniques for preventing CSRF attacks. I would recommend reading this OWASP page on CSRF attacks and preventions.