Is desactiving CSRF safe ?

Hurence / logisland.historian

a (big) data historian for IIoT

Apache License 2.0

6 stars 6 forks source link

Is desactiving CSRF safe ? #123

Open MiniPlayer opened 6 years ago

MiniPlayer commented 6 years ago

USER STORY

We added spring security to our Rest api but desactivated csrf for convenience (to not handle csrf token). Is this really safe ? (we have a stateless rest api).

ACCEPTANCE CRITERIA

1. 1. 1.

DEFINITION OF DONE

Code builds without warnings (technical task)
Code unit tested (technical task)
Code is reviewed by a peer colleague
Documentation updated (user story)
Build pushed to demo server (user story)

amarziali commented 6 years ago

My two cents:

we use JWT tokens and no cookies (no session on server side for anything)

There is nothing exploitable for a blind CSRF attack (unless proof of contrary).