1

I'm trying to use the Hapi's plugin Crumb to implement a solution againts CSRF attacks, but seems that I didn't get the solution flow. I could simply set a token in each http response as a cookie. And here comes the question, how REST can validate CSRF token, if token issued by client? How REST backend understand what this random string is valid for this request and another random string is not?

1 Answer 1

11

It's not possible to generate CSRF token on the client. It should be sent from the server to the client first, some JS frameworks extract it automatically from the cookie and send it to the server.

The basic idea is that user is supposed to send token along with a cookie and also in the post data. Here is a simple example. If attacker will trick a user to send a particular request to a service, for instance malicious website can have an image with this link src="gmail.com/deleteaccount=true". If user is logged in to gmail. Gmail will think that it was a user who made the request, because cookie send along with request is valid. So, in order to make sure that it was actually a user, gmail also requires a token send with a request data: so instead of gmail.com/deleteaccount=true it needs gmail.com/deleteaccount=true&token=987y23459827345sdfg. Token have to match the one stored in the cookie. So when request is received by a server, it checks if token in the cookie equals to token in the request body. Attacker have no access to user's cookies and don't know the token. Here is the simplified data flow:

enter image description here

In more details it looks like this:

    1. User sends GET request to a server
    1. Server sets the cookie with sessionid, and saving session data with the token
    1. server returns HTML with a form containing token in a hidden field.
    1. User submits form, along with a hidden field
    1. server compares token from the submitted form (hidden field) with the token saved in the session storage. If they match, it means that form is submitted by a user.

Here is another great answer: Why is it common to put CSRF prevention tokens in cookies?

5
  • that means when user make a post, the randomly generated token saves immediately in cookie and when it goes to the server, server checks the cookie token and request token are same or not. if it is same then it gives the access??? @RB_ Oct 20, 2017 at 9:22
  • @WahidSherif In it's simplest form it will be something like this:1 - You save a token in the user's session. 2 - You add hidden field containing the same token to a form that you are rendering. When a form is submitted, it contains the CSRF token, so you know that form was submitted by user.
    – RB_
    Oct 20, 2017 at 22:45
  • For example , X is server, Y is user. a token generates every time when Y post something to the X. the token saves in Y's session while Y is submitting the form. also the token goes as a hidden field to Server X. X checks both session token and hidden token of Y. If they matched X allows to enter. ?? Oct 22, 2017 at 10:11
  • I guess you can put it that way, but you dont have to generate a new token for every form POST, just make 1 token per session.
    – RB_
    Oct 24, 2017 at 8:29
  • How can server know that i have generated a knew token on my current session? Oct 24, 2017 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.