Usually, the web server that is serving a page includes the CSRF token inside the HTML. However when I'm using a cross-origin REST API, there is no "initial" page that could include the CSRF token.

My idea is to respond with a CSRF token after the user logs in, but I'm not entirely sure if this protects against a CSRF-attack?

  • 1
    The alternative is to expose a service that returns a CSRF token, which should be included in the next request. Being that web services typically use header-based authentication, I'm not sure if a CSRF token applies. Oct 29 at 12:24
  • There are two common solutions - csrf in the header with cors (if you control web servers which apis you call) or samesite cookie. Other scenarios may include defining additional domains. Oct 31 at 0:30

What you are referring to is a stateless API request where you need to prevent CSRF on the initial caller request.

What you need here is a mechanism called a double-submit-cookie

But you have not made it clear which endpoint you control so I am unable to derive if this solution will work for you because in a stateless scenario there are limited options, and even less ability to implement security controls when you have no control over both endpoints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.