JGe356144 (Community Member) asked a question.
Do we need anti-forgery token for internal only API?
We have an API project that only accessible internally by server side c# code using windows authentication. VeraCode reports CWE 352 (Cross-Site Request Forgery (CSRF)) on the API's post methods.
My question is: do we really need anti-forgery protection for these API methods? They are internal and accessed only by sever side code.
Thanks.
.png){kind=logo}
Hi @JGe356144 (Community Member) ,
As Windows Authentication is typically sent automatically by the browser these APIs would be vulnerable to CSRF. Whether or not an internal API is in-scope or not is not something that Veracode can speak to, this is something your Security Team can speak to.
However, from Veracode we highly recommend disregarding network controls as they are easily bypassed and especially with modern ways of working are increasingly irrelevant.
A simple way an attacker could access the API for example would be to trick a logged in user (for example by sending an email) to go to an attacker controlled website that makes a request on your API in the background.
Thank you,
Boy Baukema
Our web application architecture is like this:
Front tier is MVC web application, middle tier is shared web APIs. User makes requests to action methods in MVC web application. Inside MVC action methods, we call various APIs to get the results and return the results to user.
These APIs only called by back end code. What would you recommend when would we generate the anti-forgery tokens and where these tokens are stored? I know in normal web application, the token is generated during the page load and browser stores these tokens in cookies. However, if we call these APIs from server side, when to generate the tokens and where to store the tokens would be an issue. Any recommendations?
Thanks,
Hi @JGe356144 (Community Member) ,
Unfortunately It's difficult to answer this question without knowing more about your tech stack and how your application and authentication work, you may want to consider scheduling a consultation. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
In general though, you would need to get the AntiForgeryToken from the server after the user has been authenticated then for non-GET actions send the __RequestVerificationToken in the request.
You can find more information on how this works here: https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-5.0 .
Thank you,
Boy Baukema