0

I'm designing a CSRF defense in a Grails 2.4.5 application.

I would like to use the Synchronizer Tokens pattern, and here is the design I intend, simplified:

  1. With a new session, on the server, generate a long unique csrf token.
  2. Store the csrf token in the session.
  3. Add the csrf token to the response header
  4. On the server, for every incoming request that will potentially change application state (post, update, delete...) validate that the referer/origin is the same as the target
  5. On the server, for every incoming request that will potentially change application state (post, update, delete...) check the presence and validity of the csrf token in the header.
    In a grails app, I imagine this taking place in the Spring Security filterchain.
  6. If the token is not present or does not match, return an error and log a potential CSRF attack, otherwise allow the request to proceed.

Does this sound correct?

My concern is that it's not sufficient. Officially, the synchronizer token is added to every form and every post, put, or delete URL. Yet, the application doesn't use form tags, so it seems to be onerous to add it to every single JavaScript-generated form in the application, not to mention requiring extensive testing to make sure no existing functionality is broken.

Thanks!

GLaDOS
  • 683
  • 1
  • 14
  • 29
  • "With every incoming post request validate that the referer/origin is the same as the target" That already happens with CORS in the browser – James Kleeh Sep 14 '17 at 03:02
  • Huh. I did not know that. It's part of the recommended anti-csrf from OWASP. – GLaDOS Sep 14 '17 at 17:48
  • @JamesKleeh I don't think I understand your comment. "With every incoming post request validate that the referer/origin is the same as the target" means at the server level, validate that the message header's referrer / origin is the same as the target. I don't see how the browser could do that. Otherwise it would be extremely difficult to pull off CSRF to begin with. – GLaDOS Sep 15 '17 at 15:14
  • I see I must not have been clear enough in my description. – GLaDOS Sep 15 '17 at 15:34

0 Answers0