Implement X-CSRF pattern

Question

Hello,

I would like to Implement X-CSRF pattern as per the documentation below:

https://learn.microsoft.com/en-us/azure/api-management/policies/get-x-csrf-token-from-sap-gateway

But the above documentation is for SAP Gateway. Is there any documentation where the Gateway is Azure API-Management gateway itself?

Thanks for your answer in advance.

Regards,
Chaitanya

Answer 1

Thank you for reaching out to Microsoft Q&A. I assume you are looking to fetch CSRF token from APIM gateway instead of SAP gateway. The sample policy mentioned above implements X-CSRF token for SAP gateway which uses cookie-based authentication, and the flow is described here. Cookie-based authentication are vulnerable to CSRF attacks, and hence need for X-CSRF pattern.

However, Azure AD is token-based authentication which uses JWT (JSON Web Token) and refer Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core for more info. Also, check SO thread for similar discussion.

So APIM uses JWT token and doesn't support cookie-based authentication and hence you cannot fetch CSRF token from APIM gateway. I hope this answers your question and feel free to add a comment for any other questions. Would be happy to answer if any. Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community.