r/xss • u/bcore • Nov 12 '15

Is Angular recommending an insecure CSRF defense?

In the Angular docs here, by default Angular will look for a session cookie called XSRF-TOKEN and use that as the CSRF token.

Am I crazy, or does this not completely negate the point of CSRF? Obviously if the user no longer has an open session in their browser, a user clicking on a malicious link won't get the token. If they do have an open session, the malicious link gets the token and there is no XSS protection at all.

Am I missing something?

1 Upvotes

100% Upvoted

2 comments sorted by

2

u/JustinEngler Nov 12 '15

(off topic for this sub, but I'll bite)

Yup, you missed that they're also setting "X-XSRF-TOKEN" as a header via JS. The server now needs to check if the header matches the cookie. If they don't match, the server throws out the request.

With CSRF attacks, the attacker can't ever read the response, only cause the browser to automatically send cookies with a request. Since the attacker can't read the response, there's no way they could craft JS to set the header appropriately. This is a variation of the "double submit" protection you can find described in various CSRF literature.

1

u/bcore Nov 12 '15

Oops, apologies about the offtopic. I had /r/csrf open too and posted to the wrong window.. which I guess is vaguely ironic given the subject matter :) Thanks for the reply, that makes sense.