I want to protect my application against XSRF. Although I couldn't really understand what the problem is and how my solution works, after some research I came up with a solution, which Angular uses. As far as I got, my solution requires the following steps:
- Client sends a request for my SPA.
- I send XSRF-token (not HTTP-only so that JS will be able to read it). I also save this XSRF-token to the users session on the server.
- For every POST request I want my client to read the XSRF-token and set a
X-XSRF-TOKEN
header to this token. - I'll check every request by checking if the request header and the user session XSRF-token match. If they do, I'll also check JWT for authentication if I need.
- After validating the XSRF-token, I'll make changes to the database. Also I'll change XSRF-token again, and send the new token to the user, and change token for the session.
But I am not sure how this helps, if I have a XSS vulnerability, since any injected JavaScript code could also do the same. I want to understand the problem and how such a solution helps.
FYI, I am also implementing JWT based authentication, using Redis for session management, on an Express server.