What would be a good way to obtain route-specific CSRF tokens for an API?

Question

Recently I have started rewriting my Rails app to Roda, and encountered a hiccup.

While Rails uses a single CSRF token for the entire application (and stores it in a meta tag), Roda recommends using route-specific CSRF tokens.

So, if I have a table of entities on my index page, and I'd want to edit (and update) some of those entities inside said table, I would naturally need to obtain tokens for each entity (since each of them has their own path).

Currently, I ship the tokens in a field in the JSON api, so it looks a bit like this:

{
    "createToken": "D5pnSokPWiutf2X0Z+lCUshSNfJs3Sv+MvNcg8lxmg3Uh5r57I/EX2ObG1aAChVrxXq1/efv61akUsoN9grt",
    "data": [
        {
            "_meta": {
                "updateToken": "KKNnxZ9BAdSSjH5oQvHr3AwXcyUHOWH3pHNT1VSTNMqXOVLg4/rK3JQH3h6DeBucGdfvQM+MQU8HGibxonah"
            },
            "id": 109,
            // Omitting more data
        },
        // Omitting more elements
    ]
}

But I'm not happy with it. After all, the point of a CSRF token is that it should be hard to obtain for an attacker, but here they can obtain it with just an extra query...

So, is this a good way to serve the entity-specific tokens from backend to frontend? Are there any better ways?

Thank you.

Answer 1

If you aren't changing a form's action/method at runtime, you should be able to embed a CSRF token in each form. Then this shouldn't be an issue. However, I'm not exactly sure what you are trying to do.

For cases where you are dynamically generating requests, one possible approach is to have a route (API endpoint) that returns a CSRF token for a given route (path/request method), and protect that using an embedded CSRF token. That prevents an attacker from getting a CSRF token for a given route without already having an valid CSRF token. However, it doesn't provide significant security value over just having a CSRF token that works for all routes.

If an attacker can get access to a valid CSRF token, then you are correct that it serves no purpose. If you can securely provide a single CSRF token (as you were doing with Rails) but not route-specific CSRF tokens, it may be simpler to disable route-specific CSRF tokens in Roda.