CSRF Token help with React Front end | Java Community | Help. Code. Learn. | Page 1

wet geyser Apr 25, 2023, 1:22 AM

#

I have a react front end, and I can register and login, but when ever I try to make a post request on one of my forms it's always 403 Forbidden. I've narrowed it down to being the CSRF token causing this issue but I don't understand why it is. I have a get route that will get me a csrf token, then on my post request I add the csrf token in the headers along with my JWT token and things just begin to fall apart, I'm pretty lost at this point, and need some explanations and a point in the right direction.

My code
https://gist.github.com/CydoEntis/ceb3ee75b56e80c9a14e0711b74e38b3

mighty rootBOT Apr 25, 2023, 1:22 AM

#

⌛ This post has been reserved for your question.

Hey @wet geyser! Please use /close or the Close Post button above when you're finished. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.

TIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here.

sick kite Apr 25, 2023, 1:25 AM

#

CSRF tokens are typically in the post body, not the header.

#

Can’t remember which backend you’re using, but might wanna check where it’s expecting the token to be.

wet geyser Apr 25, 2023, 1:26 AM

#

I am using spring boot for my backend.

sick kite Apr 25, 2023, 1:30 AM

#

Quickly checking online documentation, seems you have the option of sending it in the header but it’ll need to be “X-XSRF-TOKEN” which is slightly different from the one in your gist.

wet geyser Apr 25, 2023, 1:31 AM

#

Can you link me this documentation? Clearly Im reading the wrong stuff

sick kite Apr 25, 2023, 1:32 AM

#

Was just the first thing I found https://www.baeldung.com/spring-security-csrf

Baeldung

A Guide to CSRF Protection in Spring Security | Baeldung

Learn how CSRF attacks work on a practical Spring application, and then how to enable protection against these kinds of attacks with Spring Security.

wet geyser Apr 25, 2023, 1:33 AM

#

AHh yeah i read through this and followed it, and still same the issue, so maybe my issue isn't the sending of the token but receiving it?

#

If our stateless API uses token-based authentication, such as JWT, we don't need CSRF protection, and we must disable it as we saw earlier.

Should I just opt not to do it? I remember you telling me that it's a good idea to add the CSRF protection as well though.

sick kite Apr 25, 2023, 1:42 AM

#

As mentioned previously, the SO answer suggested using both methods to future proof against someone changing the JWT to be transmitted via cookie instead of a header, not realizing it was also being used for CSRF protection. Which is a situation that surely isn’t a concern for you in this case? So whether you use it or not doesn’t really matter. Regardless, if Spring doesn’t support it then that’s that.

wet geyser Apr 25, 2023, 1:45 AM

#

Ok, and yes I was just adding the CSRF token because I thought it should be added a long side the JWT but It isn't really required for my application.

#

I should however send the JWT token on every request to the backend so I can verify the user is who they say they are correct?

sick kite Apr 25, 2023, 1:50 AM

#

Yep absolutely.
As long as you’re always going to be using a JWT to validate the user on every request, you don’t have to worry about csrf.

#

But if you ever switch to automatic validation (such as through a cookie) then csrf attacks become possible.

wet geyser Apr 25, 2023, 1:51 AM

#

I dont need it on every request though just where the user needs to be authenticated right? Basically my user can view all content of my app, but can't create, edit or delete content unless they are logged in. So for get requests the JWT isn't really needed?

wet geyser Apr 25, 2023, 1:51 AM

#

sick kite But if you ever switch to automatic validation (such as through a cookie) then c...

What would automatic validation examples be?

sick kite Apr 25, 2023, 1:58 AM

#

A session cookie is a form of automatic validation.
It would be bad to assume that just because a user has this cookie, that the request was intentionally sent by them.

As for whether or not you need a JWT on every request. It’s certainly needed for requests that make changes to the content, since it’s acting as a csrf token as well. Although, if you’re not using the JWT to validate read access, then how are you ensuring that content is only viewed by people who should be able to view it? Or is that not relevant, such as an all public content thing?

wet geyser Apr 25, 2023, 1:59 AM

#

it is all public content. you just can't add/edit/delete content unless you are authenticated.

sick kite Apr 25, 2023, 2:01 AM

#

In that case, the only need that comes to mind for authenticating users is to enforce rate limiting and attribute potential attacks to the specific individual. Up to your use case though.

wet geyser Apr 25, 2023, 2:05 AM

#

Alrighty, I appreciate the help! I think i got a better understanding of all of this now 🙂

sick kite Apr 25, 2023, 2:21 AM

#

If it suits your fancy, wanna do a lad a favor and close the question and click the “Thank Justis” button that pops up? 🙏🏻
I just needed one more imaginary discord point to get that colorful rank.

wet geyser Apr 25, 2023, 2:22 AM

#

yeah, i couldnt find my other question to close it, but I will close this one now 😄

mighty rootBOT Apr 25, 2023, 2:22 AM

#

wet geyser yeah, i couldnt find my other question to close it, but I will close this one no...

If you are finished with your post, please close it.
If you are not, please ignore this message.
Note that you will not be able to send further messages here after this post have been closed but you will be able to create new posts.

#CSRF Token help with React Front end