是否需要为每个请求/响应在JWT令牌中续订CSRF令牌？

Question

I'm developing a web application using symfony and JWT token for authentication. For preventing XSS, JWT token is stored in cookies with HttpOnly attribute. And for preventing CSRF, I used random csrf token. This token are stored in cookie and JWT token (encrypted). What I want to know is, is it necessary to renew csrf token in every response? Whats the best implementation?

Here's my settings in details:

• We've got a single page app. Most requests will be sent using ajax.
• The user authenticates using POST.
• On successful authentication, the server will generate random csrf token then store it in the cookies (HttpOnly) and inside JWT payload. Before it is stored in JWT payload, the csrf token will be encrypted.
• After JWT token is encoded, it will be stored in cookies (HttpOnly)
• Evertime user request to access another page, the server will validate the csrf token in cookies dan JWT token when JWT token decoded.
• LocalStorage is not used because it is accessible through javascript

Answer 1

Generally there is no need to renew CSRF token at every request.

BUT let's see what happens in your setting:

• you store your JWT as well as CSRF token in cookie,
• you visit malicious website that provoques a malicious request with malicious data to your site,
• your browser attaches a cookie to this request with JWT+CSRF,
• your security is broken.

So you must not put CSRF token in cookie because it is useless whether you renew it or not.

If you use "single page application" it would be better to pass JWT in Authorization header. That makes CSRF-attack impossible (watch out anohter threats).

If you use "classical web application" it would be better to use "classical" CSRF tokens and "classical" session identifiers.