Do single page applications need CSRF?

Do single page applications need CSRF?

Yes! If you are authenticating with a cookie, you need CSRF protection. This is because cookies are sent with every request, so a malicious website could send a POST request to your site and perform requests on behalf of a logged in user.

Does a REST API need CSRF?

So, yes, I think as a rule any API view should be CSRF exempt. However, you should still follow best practices and protect every API-endpoint that actually makes a change with some form of authentication, such as OAuth. CSRF attacks rely on cookies being implicitly sent with all requests to a particular domain.

How to mitigate CSRF in single page applications?

Move your API to a subdomain and use CORS for all requests, checking the origin headers. This ensures that the Origin header is present and it’s great for future-proofing your app anyway. If you can afford to not support some browsers, just use SameSite: Strict cookies, and block requests from unsupported browsers.

How to prevent CSRF attacks with REST API?

Preventing CSRF attacks on a Single Page App with REST API 1 CSRF. Let’s start with Cross Site Request Forgery (CSRF). 2 XSS. Cross Site Scripting (XSS) is one of the most common and most dangerous attacks online. 3 SOP/CORS. 4 CSRF Tokens. 5 SameSite Cookies. 6 Separate Security Domains.

Why are cookie based CSRF tokens good for spas?

Today we’ll gain a better understanding of CSRF and why cookie-based CSRF tokens are a good option for Single Page Applications (SPAs). What is a CSRF attack?

Do you need CSRF token for public API?

If you don’t want to require a CSRF Token for your public APIs, but need to need to store your auth in a cookie (to prevent XSS) for your SPA, what other options do we have to prevent CSRF? Recall that CSRF only occurs when a malicious site can trigger a request that will includes your auth cookie.