CSRF attack on Asynchronous requests

[Rahul Ba]

We are using Spring MVC Architecture with Ext JS as UI. We are using multiple Asynch. requests in application. We want to implement CSRF token. Now, we can not use new CSRF token with each requests, because Asych. requests can failed. Now, another option is to keep same CSRF token per user session. Now, When we transmit CSRF token from server to UI via (HTTPRequestHeader or cookie) there is possibility that hacker can forge the requests and get CSRF token. Now, hacker can use token to send forge requests. so, how to improve CSRF implementation here.

[Stephan van Hulst]

http://stackoverflow.com/questions/43302067/csrf-attack-on-asynchronous-requests
BeForthrightWhenCrossPostingToOtherSites

Why are you afraid that a hacker can forge the request? Are you using an insecure connection?

[Jeanne Boyarsky]

An async request doesn't mean you don't have a session so it doesn't prohibit session CSRF tokens. It doesn't even prohibit per request tokens - you can have a set of issued tokens that you validate against and have each be valid a certain length of time.

How do you authenticate the user now? Are you using https?