SEC-2460: Document CSRF with static HTML pages

[spring-projects-issues]

Migrated from SEC-2460

[spring-projects-issues]

Jaymes Bearden said:

Any progress on this ticket?

[spring-projects-issues]

Rob Winch said:

Unfortunately not at this point. In the meantime, please use the referenced SO URL for directions on how to do this.

[StephenTurley]

Question about this approach. I'd rather not have to request the token every time I'd like to post something to the server. Is it safe to store the token in memory for the lifetime of your session?

[rwinch]

@StephenTurley You can save it until you either authenticate or log out.

[StephenTurley]

I probably should have said store on the client.

[fahimfarookme]

The SO question directed me to this issue page. As per the answer given by @rwinch the static-html-page app has to make a deliberate POST call first to obtain the CSRF token and then make the actual request. However isn't it better to send the CSRF token as a response header in case of MissingCsrfTokenException ? Do you see any risk? Because some JS apps (like the one I'm developing) can be configured to resend the request based on response received - so that could avoid the the first POST call to obtain the CSRF token.

[rwinch]

@fahimfarookme The answer is somewhat contextual. Do you have external JavaScript running on your server? If so, then returning it in the body and placing it in the DOM can make the CSRF exposed.

Of course injecting JavaScript for other parties puts you in a bad position to begin with, so you could argue that isn't a valid argument. However, defense in depth says we should take all precautions.

In short, the answer (like many cases) isn't a yes/no answer.