Re:Why do we have both CSRF protection and CORS?
by mewpmewp2 on Monday March 03, 2025 @10:27AM
(#43242644)
How does server know the cookie is valid if it doesn't store it and how does it know csrf token is valid if it doesn't store it and finally how does it know that this csrf token relates to this cookie session token if it doesn't store it?
Re:Why do we have both CSRF protection and CORS?
by hansonkd on Monday March 03, 2025 @12:48PM
(#43244547)
The CSRF token can have nothing to do with the cookie session information. you can store CSRF as a separate cookie.
You can validate the CSRF is valid by keeping a key on your server and matching that the token you get can be derived from that key.
See Django's implementation of CSRF for more details. CSRF tokens are separate from session and no CSRF information needs to be stored in database to validate CSRF.
Re:Why do we have both CSRF protection and CORS?
by smagin on Monday March 03, 2025 @10:37AM
(#43242750)
> How does server know the cookie is valid if it doesn't store it
depending on why you'are asking the question, * because it decrypts correctly * because it contains some user identifier
People don't usually store sessions in cookies because cookies can't be very big, and session do become big. So what people do instead they store cookies in databases, and put session identifiers into cookies.
you don't need to store anything on the server. cookies for that domain are sent with the request and it is enough for the server to check its cookie with the csrf request data.
browsers would send the bank.com cookies with the bank.com request. It is security built into the browser which is why its so important to use secure browsers and secure cookies.
If the malicious user convinces the user to use an insecure browser you can circumvent CSRF, but at that point there are probably other exploits you can do.