XSRF protection in an AJAX style app

Question

We're currently developing an entirely AJAX based app that will interact with the server via a RESTful API. I've considered potential schemes to protect against XSRF attacks against the API.

1. User authenticates and receives a session cookie, which is also double-submitted with each request.

2. We implement an OAuth consumer in Javascript, retrieve a token when the user logs in, and sign all requests with that token.

I'm leaning toward the OAuth approach, mainly because I'd like to provide 3rd party access to our API and I'd rather not have to implement two authentication schemes.

Is there any reason why an OAuth consumer would not work in this situation?

Answer 1

Most AJAX libraries will set an additional header "X-Requested-With: XMLHttpRequest", which is difficult to fake in a basic XSRF attack (though possible if combined with XSS). Verifying that this header exists is a good defense-in-depth strategy if you expect all your requests to be AJAX.