CODEWITHSUNDEEP
ajaxangularjscsrf
dave walker
dave walker

Reputation: 3108

Is it safe to set an anti-CSRF token on $http for Ajax requests?

It seems creating and handling anti-CSRF tokens for Ajax calls in an Angular application is non-trivial and some are getting around the problem by applying a single token to every Ajax call. For example here.

The solution is quite neat. We just generate the token on the server and send it along with the first loaded page after sign-in. Then we ensure it goes out with all future requests like this:

$http.defaults.headers.common['RequestVerificationToken'] = 'token should go here';

But I am concerned this may simplify the job of an attacker. They need only get hold of $http in order to make any valid request. Is this the case? Is this method safe? Is there a 'best practice' regarding Ajax requests and CSRF?

Upvotes: 0

Views: 812

Answers (1)

Quad
Quad

Reputation: 1718

Angular automatically does this for you.

Read Cross Site Request Forgery (XSRF) Protection section. DOCS

I also suggest you read up CSRF, and what it is, if malicious script is already in your page it does not need to do cross-site requests to pose as the victim.

Upvotes: 1

Related Questions