I’m writing an application with a Svelte frontend and a Spring Boot 3 backend (version “3.0.6”).
I read about the new protection against the BREACH attack, and I applied the new configuration from Spring Security.
On my frontend, before sending any POST request, I read the value of the XSRF-TOKEN cookie and I copy that value to the header X-XSRF-TOKEN.
By debugging the code, I can see that CsrfFilter is able to extract the token value from the header.
Unfortunately, the method XorCsrfTokenRequestAttributeHandler::getTokenValue which receives two identical strings as input returns null. Given that the input is entirely defined by what my client sends, I guess that I must transform the XSRF-TOKEN value before copying it into the header X-XSRF-TOKEN.
The method code is:
// example call: actualToken = token = "b4b40051-9f64-4d8e-9092-cc84cc769ae0"
private static String getTokenValue(String actualToken, String token) {
byte[] actualBytes;
try {
actualBytes = Base64.getUrlDecoder().decode(actualToken);
}
catch (Exception ex) {
return null;
}
byte[] tokenBytes = Utf8.encode(token);
int tokenSize = tokenBytes.length;
if (actualBytes.length < tokenSize) {
// 24 < 36 so we arrive here
return null;
}
// extract token and random bytes
int randomBytesSize = actualBytes.length - tokenSize;
byte[] xoredCsrf = new byte[tokenSize];
byte[] randomBytes = new byte[randomBytesSize];
System.arraycopy(actualBytes, 0, randomBytes, 0, randomBytesSize);
System.arraycopy(actualBytes, randomBytesSize, xoredCsrf, 0, tokenSize);
byte[] csrfBytes = xorCsrf(randomBytes, xoredCsrf);
return Utf8.decode(csrfBytes);
}
When everything goes fine, this method is supposed to return the same value as “token” and the call equalsConstantTime(csrfToken.getToken(), actualToken) returns true, where actualToken is the return value of the above method.
So, what am I supposed to do with the value of the cookie XSRF-TOKEN before copying it into the header X-XSRF-TOKEN ?