在AJAX请求的$ http上设置反CSRF令牌是否安全？

Question

It seems creating and handling anti-CSRF tokens for Ajax calls in an Angular application is non-trivial and some are getting around the problem by applying a single token to every Ajax call. For example here .

The solution is quite neat. We just generate the token on the server and send it along with the first loaded page after sign-in. Then we ensure it goes out with all future requests like this:

$http.defaults.headers.common['RequestVerificationToken'] = 'token should go here';

But I am concerned this may simplify the job of an attacker. They need only get hold of $http in order to make any valid request. Is this the case? Is this method safe? Is there a 'best practice' regarding Ajax requests and CSRF?

Answer 1

Angular automatically does this for you.

Read Cross Site Request Forgery (XSRF) Protection section. DOCS

I also suggest you read up CSRF, and what it is, if malicious script is already in your page it does not need to do cross-site requests to pose as the victim.