CSRF issue about spring-security-oauth

[eugenp]

Sure, happy to help @otinanism
First, what article are you referring to specifically?
The main reason that helps is - the cookie is only used for storage, it's not sent out automatically by the browser.

Let's take a step back and talk about how a CSRF attack typically happens. In a simplified way - the browser is tricked to send a request to the main site (from another site). In that request - the cookies of that site get automatically sent out as well (default browser behavior). The problem is, of course, the request didn't actually originate from the main site. That's why you need a protection mechanism for this scenario (CSRF token, Origin check, Same-Site cookie, etc).

Now, in our case, the cookie isn't actually sent automatically, because we're only using it for storage. Hence - no CSRF vulnerability.

Hope that helps clear things up.
Cheers,
Eugen.

[atrifyllis]

I was referring to this article:
http://www.baeldung.com/rest-api-spring-oauth2-angularjs
I am probably missing something but a cookie is sent automatically by the browser. How do you prevent that from happening? Do you mean that it is sent but not used in the backend?