在非ajax帖子上添加自定义标头

Question

AFAIK it's not possible to set a header field when a form is submited, it can only be done in ajax requests

This questions also points that it's not possible:

• How to set a Header field on POST a form?
• Custom HTTP Request headers in HTML

But reading Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet it's mentioned that:

Encrypted Token Pattern

Overview

The Encrypted Token Pattern leverages an encryption, rather than comparison, method of Token-validation. After successful authentication, the server generates a unique Token comprised of the user's ID, a timestamp value and a nonce, using a unique key available only on the server. This Token is returned to the client and embedded in a hidden field. Subsequent AJAX requests include this Token in the request-header, in a similar manner to the Double-Submit pattern. Non-AJAX form-based requests will implicitly persist the Token in its hidden field, although I recommend persisting this data in a custom HTTP header in such cases . On receipt of this request, the server reads and decrypts the Token value with the same key used to create the Token.

This sentence confuses me:

I recommend persisting this data in a custom HTTP header in such cases

Could anyone shed some light on it?

Answer 1

Yes, the sentence implies that the POST operation is invoked by a custom JavaScript handler in order to inject the AUTH header. I've corrected the OWASP description to reflect this oversight.