SKackar120193 (Community Member) asked a question.
What is the best way to implement CSRF tokens at the front-end which is developed in Backbone (ver: 1.3.3) & back-end APIs is developed in Pyramid Framework (1.10.4)
We have an application where we need to implement CSRF at the front-end & to verify the same at the back-end before any POST, PUT request submits from the front-end.
It is an application having an older version of libraries of all the JS-related stuff. Please suggest what is the best one to do that.
Thanks
.png){kind=logo}
Hi @SKackar120193 (Community Member) ,
The Pyramid Web Framework version 1.10 has support for CSRF validation: https://docs.pylonsproject.org/projects/pyramid/en/1.10-branch/narr/security.html#preventing-cross-site-request-forgery-attacks
Typically, you would then get this token to the JavaScript framework (Backbone) by putting it in a <script> block in the loading page, something like:
<script>
var csrfToken = "${get_csrf_token()}";
$(function(){
$.ajaxSetup({
headers: {'X-CSRFToken': csrfToken}
});
});
</script>
Adapted from https://stackoverflow.com/a/18128507/4512 and https://docs.pylonsproject.org/projects/pyramid/en/1.10-branch/narr/security.html#preventing-cross-site-request-forgery-attacks .
Hope this helps.
Thank you,
Boy Baukema