Is it a security issue to put CSRF token in drupal settings?

Question

I have an application where I created a REST resource to update a field on the user object to store bookmarked items.

When you do a post request to a rest resource you are required to use a header with X-CSRF-Token.

You can get this by making a call to "/session/token". But I'm wondering if it's OK, if you have a "bookmarks" widget on all pages to include the token in drupal settings.

Or is this some kind of security issue?

Is it better to make a call through javascript to get the token, rather than have it in the drupal settings?

Or as long as you're logged in, having the csrf token in drupal settings is not a problem?

/**
 * Implements hook_preprocess_HOOK().
 */
function mymodule_preprocess_page(&$vars) {

  // Add CSRF token to page for authenticated users.  Token
  // is required by rest resources on POST requests.
  if ($vars['logged_in']) {

    $route = \Drupal::routeMatch()->getRouteObject();
    $is_admin = \Drupal::service('router.admin_context')->isAdminRoute($route);

    if (!$is_admin) {
      $vars['#attached']['drupalSettings']['user']['csrf'] = \Drupal::csrfToken()->get(CsrfRequestHeaderAccessCheck::TOKEN_KEY);
    }
  }
}

Answer 1

Drupal.settings, and other global variables, will be available to cross-origin scripts that happen to be injected (possibly maliciously) into the site. The same applies to any other part of the document body, like meta tags or JSON script tags.

Sensitive tokens should ideally be stored in a place that is restricted to same-origin scripts, which includes cookies and localstorage: https://stackoverflow.com/questions/34782493/difference-between-csrf-and-x-csrf-token

(This shouldn't normally be critical, because script injection shouldn't be possible in the first place, and is a severe vulnerability by itself. But it's probably still a good idea to rely on multiple layers of security.)