mardi 24 avril 2018

CSRF Implementation and Stripe API

Is the following a secure implementation of CSRF token verification? Specifically, I want to call this Stripe API endpoint:

https://connect.stripe.com/express/oauth/authorize?redirect_uri=https://example.com&client_id=ca_11111&state={STATE_VALUE} and the Stripe docs say

To prevent CSRF attacks, add the state parameter, passing along a unique token as the value. We’ll include the state you gave us when we redirect the user back to your site.

I am thinking of implementing like this: - browser generates a random token and stores it in a cookie (or local storage) - browser calls the above endpoint - stripe redirects to my application at https://example.com - when I get the response back, I check the contents of the state parameter and compare it to the value stored in local storage, or in my cookie.

Is this a secure/correct implementation of CSRF? Or do I need to somehow involve a backend service?

(Stripe docs here: https://stripe.com/docs/connect/express-accounts)




Aucun commentaire:

Enregistrer un commentaire