User-1134857695 posted
Hi everyone! I'm migrating my app to SPA. I've been investigating the matter, because I got worried about CSRF/XSRF attacks. I have a couple of concerns..
I have started to implement a token-bearer approach using OAuth and JWT through Katana, by following this tutorial: http://bitoftech.net/2015/02/16/implement-oauth-json-web-tokens-authentication-in-asp-net-web-api-and-identity-2/
After implementing it, I realized that I needed to store the JWT in a safe manner. According to the Stack Exchange network and some other websites, the best way to do this is to store it in a Cookie with HTTP flags on. This would prevent the attacker from
using a XSS mechanism and steal the token. Unfortunately this approach is susceptible of CSRF attacks, bringing me almost to square 1.
A mechanism suggested by the same sources is to use a Double Cookie implementation. In which I would send both: the CSRF token and the JWT. Despite that, I'm really worried about generating the CSRF token (which was my main problem). The best way (in
my understanding) to retrieve an anti-forgery token is to server-render it
Therefore I get the token through @Html.AntiForgeryToken in my initial load and utilize it for subsequent requests. This creates the following concern:
For how long will that token be valid? Or, how would I handle the CSRF token expiration? (Which was my main concern in the beginning)
I don't know how viable would it be to request another CSRF token from the server after the data has been sent. I'm very skeptical on retrieving tokens via AJAX calls...
I haven't found any post so far that dwells this far. So that's why I'm asking.
