Does gorilla-csrf really provide more security? about csrf

[steebchen]

I'm not sure if that's true for what @robojones suggests.
If your API just accepts POST requests, it looks like checking for the origin header seems to be sufficient in 2020 onward; assuming you use it in combination with SameSite=Strict cookies.

Also see:

https://security.stackexchange.com/questions/158045/is-checking-the-referer-and-origin-headers-enough-to-prevent-csrf-provided-that

I'm not saying CSRF is not useful anymore, I just think that SameSite=Strict plus checking the origin header is probably sufficient for most people, and doesn't need any storage on the server.

[robojones]

@ScottyFillups

why is using SameSite=Strict cookies a requirement? Isn't reading the Origin header enough?

SameSite=Strict on cookies just provides an additional layer of security.
I did look into this and checking the Origin header should be sufficient to prevent CSRF.

Doesn't that mean the Origin header is sent for all cross-domain POSTs over HTTPS? As for GET and HEAD, as long as you ensure those methods don't mutate state, you should be fine to skip the origin check, right?

Yup

[philipjscott]

@steebchen why is using SameSite=Strict cookies a requirement? Isn't reading the Origin header enough?

@elithrar regarding:

which may not be present in all cases, and certainly not for a cross-domain POST over HTTPS

According to https://fetch.spec.whatwg.org/#cors-request,

A CORS request is an HTTP request that includes an Origin header. It cannot be reliably identified as participating in the CORS protocol as the Origin header is also included for all requests whose method is neither GET nor HEAD.

Doesn't that mean the Origin header is sent for all cross-domain POSTs over HTTPS? As for GET and HEAD, as long as you ensure those methods don't mutate state, you should be fine to skip the origin check, right?

[elithrar]

Please take a look at https://owasp.org/www-community/attacks/csrf and https://portswigger.net/web-security/csrf Validating the Origin / Referer headers - which may not be present in all cases, and certainly not for a cross-domain POST over HTTPS - does not protect you from CSRF attacks.

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.

[robojones]

Thanks for clarifying that @elithrar 👍

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.