javascript - Protecting against CSRF attacks in Aurelia -

in aurelia, there doesn't seem support csrf protection yet, opposed angularjs's xsrf-token header set automatically on xhr requests angularjs framework.

how should go protecting aurelia app csrf attacks? should roll own support based on owasp csrf prevention cheat sheet, or there alternatives out there aurelia already?

you should able using aurelia's http interceptors (see examples in docs). before every request, can send token. can done both conventional aurelia-http-client , new standard aurelia-fetch-client.

your code might this:

export class myrestapi {     static inject () { return [httpclient]; } // fetch-client      constructor (http) {         this.http = http.configure(x => {             x.withbaseurl(mybaseurl);             x.usestandardconfiguration();             x.withinterceptor({                 request: function (request) {                     request.headers.set('xsrf-token', myawesometoken);                     return request;                 }             });         });     }      ...  } 

on every request, token sent. you'd have handle validation on server side. set code initial request grab token, or pass token part of authentication payload, or if wanted store token in browser's localstorage , use way.

you go step further , implement jwt authentication. if you're using node.js, have small blog post describes how implemented jwt in express. there's plugin on github called aurelia-auth handles jwt, , there's blog post on implementation on aurelia blog well.