4

I have an application where I created a REST resource to update a field on the user object to store bookmarked items.

When you do a post request to a rest resource you are required to use a header with X-CSRF-Token.

You can get this by making a call to "/session/token". But I'm wondering if it's OK, if you have a "bookmarks" widget on all pages to include the token in drupal settings.

Or is this some kind of security issue?

Is it better to make a call through javascript to get the token, rather than have it in the drupal settings?

Or as long as you're logged in, having the csrf token in drupal settings is not a problem?

/**
 * Implements hook_preprocess_HOOK().
 */
function mymodule_preprocess_page(&$vars) {

  // Add CSRF token to page for authenticated users.  Token
  // is required by rest resources on POST requests.
  if ($vars['logged_in']) {

    $route = \Drupal::routeMatch()->getRouteObject();
    $is_admin = \Drupal::service('router.admin_context')->isAdminRoute($route);

    if (!$is_admin) {
      $vars['#attached']['drupalSettings']['user']['csrf'] = \Drupal::csrfToken()->get(CsrfRequestHeaderAccessCheck::TOKEN_KEY);
    }
  }
}
  • 2
    Probably slightly off-topic from Drupal, but it may be insecure. Best practice would be to store it in something restricted to the origin so that it is not exposed to cross-origin scripts (iframe). Local storage should work for that. Cookies as well. – mradcliffe Oct 11 '18 at 19:54
  • 3
    This has some good answers related to JWT tokens and there's some discussion about CSRF as well: stackoverflow.com/questions/44133536/… The accepted answer there is overly cautious about local/session storage because of a fear of browser extensions accessing the token and working around the same origin policy. – mradcliffe Oct 11 '18 at 19:57
  • 1
    does it really need to be a REST resource ? if you dont have other clients consuming the resource ... then you can just handle the bookmark action in a controller as Drupal all-ready knows who is accessing it and just return a JsonResponse if it was bookmarked or faild ?? – Taggart Jensen Jan 10 at 0:19

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.