<story><title>Securing your API: a modern alternative to CSRF tokens</title><url>https://mixmax.com/blog/modern-csrf</url></story><parent_chain></parent_chain><comment><author>ejcx</author><text>Why make an extremely complicated set up, with many edge cases, all to save yourself from a single token?&lt;p&gt;&lt;pre&gt;&lt;code&gt;    - Privacy extensions often times block referrer headers.

    - POST requests are usually necessary.

    - Open redirects are common bugs, and getting your website to initiate one can be a problem.

    - Disabling CORS also relies on you killing crossdomain.xml, which you might overlook.
&lt;/code&gt;&lt;/pre&gt;
Instead you can just roll out CSRF tokens.&lt;p&gt;Having rolled them out myself many times. You probably want to use a library if you aren&amp;#x27;t a cryptographer or security person:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    expiration_time_of_1_day || hmac_sha256( secret_key, { expiration_time_of_1_day, user_id })
&lt;/code&gt;&lt;/pre&gt;
I&amp;#x27;ve seen other people mention SameSite cookies, but we aren&amp;#x27;t near a time when browsers all support them. Don&amp;#x27;t get fancy preventing CSRF. It&amp;#x27;s a stupid bug.</text></comment>
<story><title>Securing your API: a modern alternative to CSRF tokens</title><url>https://mixmax.com/blog/modern-csrf</url></story><parent_chain></parent_chain><comment><author>arkadiyt</author><text>I used to prefer the origin&amp;#x2F;referer approach to blocking CSRF because it can be done upstream of the application server (or in a middleware), transparent to developers who often get these things wrong.&lt;p&gt;However there&amp;#x27;s been enough referer spoofing browser bugs lately that I&amp;#x27;d rather have the extra safety (and complexity) of CSRF tokens. Just 3 months ago Edge had (another) referer spoofing bug:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.brokenbrowser.com&amp;#x2F;referer-spoofing-patch-bypass&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.brokenbrowser.com&amp;#x2F;referer-spoofing-patch-bypass&amp;#x2F;&lt;/a&gt;</text></comment>