403 security auth_error ai_generated true

CSRF token missing in AJAX request header

ID: security/csrf-token-missing-in-ajax-request

Also available as: JSON · Markdown · 中文
90%Fix Rate
85%Confidence
1Evidence
2023-11-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Django 4.2 active — — —
Spring Security 6.1 active — — —
Rails 7.0 active — — —

Root Cause

The frontend JavaScript code does not include the CSRF token in the X-CSRF-Token header for AJAX requests, so the server-side middleware rejects the request with a 403 status.

generic

中文

前端JavaScript代码未在AJAX请求的X-CSRF-Token头中包含CSRF令牌，导致服务端中间件以403状态拒绝请求。

Official Documentation

https://owasp.org/www-community/attacks/csrf

Workarounds

  1. 95% success In the frontend, add a global AJAX setup to include the CSRF token. For jQuery: $.ajaxSetup({ headers: { 'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') } }) 
    In the frontend, add a global AJAX setup to include the CSRF token. For jQuery: $.ajaxSetup({ headers: { 'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') } })
  2. 90% success Ensure the meta tag containing the CSRF token is rendered in the HTML template and is accessible to the JavaScript code. 
    Ensure the meta tag containing the CSRF token is rendered in the HTML template and is accessible to the JavaScript code.
  3. 85% success Use a fetch wrapper that automatically adds the CSRF header from a cookie or meta tag to all requests. 
    Use a fetch wrapper that automatically adds the CSRF header from a cookie or meta tag to all requests.

中文步骤

  1. 在前端，添加全局AJAX设置以包含CSRF令牌。对于jQuery：$.ajaxSetup({ headers: { 'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') } })
  2. 确保包含CSRF令牌的meta标签在HTML模板中渲染，并且JavaScript代码可以访问它。
  3. 使用自动从cookie或meta标签添加CSRF头到所有请求的fetch包装器。

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Disabling CSRF protection globally in the framework removes a critical security control, making the application vulnerable to CSRF attacks.

  2. 50% fail

    Only adding the token to form submissions but not to AJAX requests leaves the AJAX endpoints unprotected.

  3. 60% fail

    Placing the token in a query parameter instead of a header can leak it in server logs and browser history.