Can multiple endpoint use same CSRF token?

Question

I have Single Page Application(SPA) with multiple endpoints using Singe Sing On(SSO) with JWT token. I try to figure out how to initialize a CSRF token while still keeping my frontend and backend logic as simple as possible.

My question is: Is there a way to avoid generating a CSRF token for every endpoint? So can I, for example, generate CSRF token during my login process (first fetch CSRF token and rotate the token in every login request) and then verify that one CSRF token in every backend? How could this be implemented if it is somehow possible?

I use X-CSRF tokens, so on the server side the token is set to cookies, then the client duplicates it to request headers and finally server verifies that cookie and header value match. I use django csrf middleware which also does some extra validation to avoid client self generated tokens. This extra validation is something I do not really understand

Answer 1

In my opinion, what you have in mind is not possible. But you could communicate with a proxy that knows the other endpoints. That would make the most sense from my point of view. So you only need the CSRF token for this one endpoint. And on the server side from the proxy to your other servers you don't need CSRF anymore. But this solution means you need an additional endpoint.