Angular和PHP JWT和CSRF（XSRF）Cookies

Question

I have an Angular app making $http requests to a PHP server. Once a valid login request has been submitted to the server, PHP creates a JWT and sets the token cookie using PHP's setcookie() function with the httponly flag set to true. This flag allows only the server to read the cookie. On each subsequent Angular $http request, the cookie is validated by PHP using $_COOKIE.

My question is would setting the cookie in PHP for only the server to read be safe enough from CSRF or would I need to have Angular create an additional XSRF token to be sent on each request to be evaluated as well?

I read the following Stormpath article but got a little lost on why he was setting a xsrfToken in the JWT payload. My guess was to have Angular create an XSRF token to match against.

Thanks for any advice/input.

Answer 1

CSRF attacks work by exploiting the fact that your authentication cookie is sent by the browser to the server automatically with each request. Normally, a JWT isn't passed to the server using a cookie, it's instead passed in the authentication header of your http request (it may be stored in a cookie on the client side but the cookie isn't used to pass the JWT to the server). Since you need to set the authentication header for each request, a CSRF attack cannot authenticate its malicious request since the browser isn't automatically sending an authentication cookie with each request. This is why JWTs help prevent CSRF attacks.

That said, if you store your JWT in a cookie and transfer the cookie back and forth, extracting the token to check authorization policies, then you are just as susceptible to CSRF attaks as standard cookie authentication. In this case you can add anti-forgery tokens to your requests to ensure that any HTTP requests that your server receives have come directly from your website.