CODEWITHSUNDEEP
azure-api-management
chaitanya kumar Dondapati
chaitanya kumar Dondapati

Reputation: 55

Implement X-CSRF pattern

I would like to Implement X-CSRF pattern as per the documentation below:

https://learn.microsoft.com/en-us/azure/api-management/policies/get-x-csrf-token-from-sap-gateway

But the above documentation is for SAP Gateway. Is there any documentation where the Gateway is Azure API-Management gateway itself?

Thanks for your answer in advance.

Regards, Chaitanya

Upvotes: 0

Views: 778

Answers (1)

JananiRamesh-MSFT
JananiRamesh-MSFT

Reputation: 196

I assume you are looking to fetch CSRF token from APIM gateway instead of SAP gateway. The sample policy mentioned above implements X-CSRF token for SAP gateway which uses cookie-based authentication, and the flow is described here. Cookie-based authentication are vulnerable to CSRF attacks, and hence need for X-CSRF pattern.

However, Azure AD is token-based authentication which uses JWT (JSON Web Token) and refer Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core for more info. Also, check SO thread (Difference between CookieAuthentication and WindowsAzureADAuthentication Options) for similar discussion.

enter image description here

So APIM uses JWT token and doesn't support cookie-based authentication and hence you cannot fetch CSRF token from APIM gateway.

Upvotes: 0

Related Questions