Search code examples
restsecuritycsrfapi-design

How to prevent CSRF in API-Centric Web Application

I am looking to build a web application using API-Centric architecture.

The frontend of the application would make requests to the REST API using AJAX.

How could I implement a robust CSRF prevention strategy for this application?

Solution

  • Some proposition: First You can use api-url like GET api/gime-csrf which return CSRF token as response and also set it in http-only cookie (so JS has no access to it - but remember to block TRACE request in server to prevent XST attack). Then when you make some "save state" request like POST/PUT/PATCH - you just put CSRF in some request header - and in server you compare header token value with cookie token value.