Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    Related: stackoverflow.com/questions/4201239/… Commented Mar 31, 2016 at 22:31
  • 1
    Do you mean sending a one time generated token in every request ? Or it will updated too in every request ? The CSRF approach creating a new token which is a specific to a form/page in every request by backend. Commented Mar 31, 2016 at 22:56
  • 1
    One time generated would be preferred for a bunch of reasons I've omitted (this should be running on machine with very little resources and avoiding updating data on the DB would be preferrable). I would like to highlight the fact that the token I'm using is for authentication, not a CSRF-token Commented Mar 31, 2016 at 22:59
  • 1
    In fact local storage is accessible from the browser what you save on it client could read from it. I could suggest an approach don't make a direct request to your API from javascript. Place a middleware backend script which can make the request to the API adding x-access-token etc. And securing JS to middle backend it could be CORS and (timestamp + userIp + endpoint & request details) by hashing and you can use https here, and in middle backend application you can use session to write this things to diferantiate request from each other. Commented Mar 31, 2016 at 23:15