CSRF & CORS with AngularJS + Laravel

Question

I'm working on an AngularJS webapp with a Laravel backend.

I want to enable CSRF protection with cross-domain requests. Is it possible?

$http reference in "Cross Site Request Forgery" says "The header will not be set for cross-domain requests"

Looking the Developer Tools logs I see that after the $http.post call the preflight request is sent (OPTION verb) and it has the XSRF-TOKEN cookies set, but the POST request has no cookies so I can't do:

$http.defaults.headers.post['X-CSRFToken'] = $cookies['XSRF-TOKEN'];

Any idea?

UPDATE:

@zeroflagL: I tried with

$http.defaults.headers.common.xsrfCookieName = 'XSRF-TOKEN';
$http.defaults.headers.common.xsrfHeaderName = 'X-XSRF-TOKEN';

And now in the Request headers of the POST I have:

xsrfCookieName:XSRF-TOKEN
xsrfHeaderName:X-XSRF-TOKEN

But the CSRF check is not passed (TokenMismatchException on the server). I suppose that in the Request headers there should be the XSRF-TOKEN to work...

Did you set xsrfHeaderName and xsrfCookieName as said in the documentation? — a better oliver
– a better oliver, Commented Nov 12, 2015 at 16:53
Remove headers.common. It's just $http.defaults.xsrf.... — a better oliver
– a better oliver, Commented Nov 12, 2015 at 21:07
It should be correct with $http.defaults.headers.common.xsrf..., if I use your form nothing is set in the POST request headers. BTW this doesn't resolve the problem — Mat
– Mat, Commented Nov 13, 2015 at 7:39
Example: You have a website http://myweb.com. The user is logged in. The user opens the site http://evil.com in another tab. That evil site embeds an image tag having the URL http://myweb.com/transferMoney. Because the user is still logged in, the session id is sent and the request seems ok from the servers perspective. If the client runs on the http://anotherweb.com and makes a Cross-Site request to http://myweb.com then XSRF isn't an issue because the request doesn't appear to come from your site anyway. — a better oliver
– a better oliver, Commented Nov 13, 2015 at 18:15

Mat · Accepted Answer · 2015-11-16 13:21:21Z

1

As zeroflagL said CSRF protection can't be applied to cross domain requests.

To reply to my question: no, it's not possible.

answered Nov 16, 2015 at 13:21

Mat

2,2042 gold badges18 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

CSRF & CORS with AngularJS + Laravel

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related