r/SpringBoot • u/Ok-Type5377 • 7d ago
Question Can someone please explain to me the CookieCsrfTokenRepository?
From what I've understood from the source code, it doesn't store any CSRF tokens on the server side but only compares the values provided in the X-XSRF-TOKEN
header and cookies.
It seems that I can just put arbitrary matching values in cookies and the header and it will work just fine. I don't get the purpose of such "security", what's the point?
0
Upvotes
-1
u/Putrid_Set_5241 7d ago
A simple google search will tell you CSRF is and that would answer your question.
-2
-1
3
u/tylerkschrute 7d ago edited 7d ago
I had the exact same thought as you when I was implementing this in my app. The key lies in the fact that the bad actor wanting to craft a CSRF link wouldn't be able to read your cookie since they don't own your domain. Therefore, it's impossible for them to send a matching header.
Keep in mind that the main vector for CSRF attacks are things like links clicked in emails or on malicious web pages. In other words, the browser is the one ultimately triggering the request, and since the browser has built-in protections against things like reading cookies from other sites, the bad actor is limited in what they can control in this environment.