登录后是否需要csrf令牌？

Question

I'm building a simple todo list where the user will login (with csrf-token) and then be able to add items to the todo list. Would I need to add csrf_tokens to submissions using AJAX (todo list items) after the the user has already logged in? I'm using session based authentication.

Answer 1

Well I'd say yes you have to do it, look at this excerpt taken from owasp ( Open Web Application Security Project ) documentation:

When targeting a normal user, a successful CSRF attack can compromise end-user data and their associated functions. If the targeted end user is an administrator account, a CSRF attack can compromise the entire Web application. The sites that are more likely to be attacked are community Websites (social networking, email) or sites that have high dollar value accounts associated with them (banks, stock brokerages, bill pay services). This attack can happen even if the user is logged into a Web site using strong encryption (HTTPS) . Utilizing social engineering, an attacker will embed malicious HTML or JavaScript code into an email or Website to request a specific 'task url'. The task then executes with or without the user's knowledge, either directly or by utilizing a Cross-site Scripting flaw (ex: Samy MySpace Worm).