I'm thinking to CSRF protect all public AJAX requests that return JSON, because what's to prevent another site from spoofing the AJAX header and using the JSON as if it were a public API? I think CSRF protection is the best solution for this, however I'm concerned with the way Laravel handles this:
- Using laravel's CSRF filter, I notice in app/filters.php that it checks using
Session:token, will this require every public visitor to have a session and put additional requirement on server RAM (as opposed to browsing without sessions).
- In the CSRF filter, Laravel checks
Input::get('token'), but I may want to make POST ajax calls as well. Are POST requests not going to work?
- What if a visitor has a window open. They walk away for a bit...then return to perform an ajax request. This would be a problem and we would need to refresh the page, which would seem awkward for a public visitor (as opposed to logged in users, where we could just redirect to a login page).
- What if a visitor (or even logged in user) has 2 windows open? They walk away and let the session timeout. Then return and refresh one window (or login in again in one window), then go to the second window to perform an operation (only to find it doesn't work or they are forced to login again).
Can anyone address these concerns in Laravel's implementation of CSRF protection?