c# - Antiforgery token in a distributed SPA application

Question

I am working on a distributed high availability single-page-application which gets served from a cluster of docker nodes. Occasionally a node will die (for perfectly valid reasons, so that is not the issue). All the clients get then seamlessly rerouted to one of the other nodes. Unfortunately, all of their XSRF tokens are then invalid, as they were stored in memory in the client.

The question is, thus, how can we distribute storage of the current XSRF token(s) in a *nix based setup?

Answer 1

To summarize my comments:

XSRF/CSRF is only possible when you use Cookies for authentication. It allows attackers to lure users to a fake page which redirects a (typically hidden) form to your website with data filled by the attacker or by calling scripts in image tags (if get requests have side-effects, which should be avoided) , i.e.

<image src="http://yourdomain.com/user/5/delete"/>

When you use SPA (Single Page Application, Applications written in JavaScript where they are loaded only by the initial request and every other call happens via Ajax/JavaScript), then you would typically use Access Tokens (opaque token or jwt tokes) to authenticate.

Sending Tokens with each request is not vulnerable to XSRF, only if you use cookie authentication. The ASP.NET Core documentation explicitly states that:

https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery

Some attacks target site endpoints that respond to GET requests, in which case an image tag can be used to perform the action (this form of attack is common on forum sites that permit images but block JavaScript). Applications that change state with GET requests are vulnerable from malicious attacks.

CSRF attacks are possible against web sites that use cookies for authentication, because browsers send all relevant cookies to the destination web site. However, CSRF attacks are not limited to exploiting cookies. For example, Basic and Digest authentication are also vulnerable. After a user logs in with Basic or Digest authentication, the browser automatically sends the credentials until the session ends.