对Ajax呼叫禁用CSRF保护-有多严重？

Question

Guys I'm running into a lot of trouble with CSRF and ajax calls in Laravel 5.

I am sending the X-CSRF token with every ajax call in the header, as explained here: http://laravel.com/docs/master/routing#csrf-x-csrf-token

The problem is, randomly, the token cannot be verified, and I end up with the following error:

TokenMismatchException in VerifyCsrfToken.php line 46:

It happens eventually, in 1 out of 10 calls, but still makes my application behave badly, since it's very dependant on these ajax calls.

So I posted here about the problem, but the best response I got was to "disable CSRF".

I have 2 questions about it:

1) Will disable CSRF for ajax calls make my website vulnerable?

and

2) Is there another way I can protect, if I find no other way but disable CSRF?

Answer 1

The idea behind XSS attacks is that other sites trick your users into performing actions on your application using their session.

There are many types of XSS attacks out there. The following is just a simple example of one type that may happen.

So, imagine you have an admin route for deleting your website: /self-destruct . Now, imagine that you are logged into your website as admin. You have access to the route, but you would never go to it by accident.

Now, the idea is that as your browsing the web, you come along a malicious site that, for some reason or another, redirects your browser to your /self-destruct route on your application.

With CSRF protection: the malicious site doesn't have a proper CSRF token to give to you to pass along to your route. Since your route requires a proper CSRF token, you'll get a TokenMismatchException error and your website is fine.

Without CSRF protection: the malicious site doesn't need anything extra. They have redirected you, a logged in admin user, to your admin self destruct route. Your website is now gone.

Security is always a balance act. If you don't think there is any risk to XSS attacks on your website, then don't worry about it. If you're developing a banking application and you don't want an XSS attack to be able to transfer all the funds of any susceptible user to an offshore banking account, then CSRF would be a good idea.