Angular security - CSRF prevention using Double Submit Cookie
Angular security - CSRF prevention using Double Submit Cookie.
Github url - https://github.com/anuroopjoy/csrf-sa...
Details of the technique mentioned in this video is explained in details in the Angular website https://angular.io/guide/security#cro....
In this video, I have used localhost:8080 for the attacker site, instead of that we should use 127.0.0.1:8080 so that the domains are different from the angular app (localhost:4200). So the XSRF-TOKEN cookie wont be accessible to 127.0.0.1 javascript due to Same Origin Policy of the browser.
00:00 - Introduction
00:58 - CSRF vulnerable app setup
06:00 - CSRF in action
10:47 - CSRF Token security - server
15:40 - CSRF Token security - angular