Search code examples
spring-securitycsrf-protectionspring-session

CSRF protection and Spring Session header session strategy

In my spring based rest API, I'm using spring-session with HeaderHttpSessionStrategy. Given cookies are not used at all (session id is sent as a header), do I still need to worry about CSRF attacks?

I would say I'm safe, and I have read people agreeing that in this scenario CSRF protection is not needed, for example: https://security.stackexchange.com/questions/62080/is-csrf-possible-if-i-dont-even-use-cookies

However, the Spring guys argue that whenever an application is accessed by a browser you do need CSRF protection: https://spring.io/blog/2015/01/12/the-login-page-angular-js-and-spring-security-part-ii.

Solution

  • In my oppinion, if you use the HeaderHttpSessionStrategy, CSRF attacks are not possible. If you save the header token as a cookie, it is actually the same approach as the XSRF protection works. So XSRF protection does not give you any additional protection.