2

I have an exact situation with this question: What are some viable techniques for combining csrf protection with RESTful APIs?

One answer given talks about using

  • basic authentication with SSL
  • 1 API key per application
  • OAuth

I am already convinced about implementing OAuth2.0 where you will have access_token, client_id, client_secret for each app.

However, I was not aware that this would actually help prevent CSRF.

My opinion is that at the end of the day, you still need ssl.

Because in OAuth2.0, when the client app sends requests on behalf of the Resource Owner, they need to send alongside the data parameters such as client_id, client_secret and access token.

Without HTTPS, if the client_id, client_secret and access token are known either through leaks or man-in-the-middle, then there is still a chance of CSRF, albeit a small one because of the expiry period of the access token.

Is my understanding correct?

Community
  • 1
  • 1
Kim Stacks
  • 10,202
  • 35
  • 151
  • 282

1 Answers1

2

If a resource is protected by OAuth 2 alone and an attacker gets client_id, client_secret and an access token, then no CSRF is needed at all. The attacker directly can send a request to use the protected resource and will be served because OAuth 2 does not filter the source of the request, it requires an access token only.

In general, you should definitely use HTTPS both for the authentication server and the protected resource to avoid man-in-the-middle attacks. However, if you're using the "authorization code grant" scenario (i.e. use it from your own web application), then the access token is not known even to the resource owner, he can intercept the authorization code only. Thus, if your web application has a trusted (e.g. intranet) connection to both the authorization server and the protected resource, it is safe to use an unencrypted connection to the protected resource.

Zólyomi István
  • 2,401
  • 17
  • 28
  • Yes, you are. See specification http://tools.ietf.org/html/draft-ietf-oauth-v2-27, subsection 10.9. As a summary, the authorization server MUST use TLS (i.e. HTTPS) and the client SHOULD use a TLS-protected redirect_uri. Section 10 addresses several security considerations, including CSRF. – Zólyomi István Jun 14 '12 at 06:51
  • Hi there, in that case, my follow up question is http://stackoverflow.com/questions/11071482/oauth2-0-server-stack-how-to-use-state-to-prevent-csrf-for-draft2-0-v20 – Kim Stacks Jun 17 '12 at 13:05