Is CSRF token enough to prevent XSSI attack? - security

Question

I have read about XSSI attack prevention in Google Gruyere page.
Three main recommendations from Gruyere to prevent XSSI attack:
First, use an XSRF token as discussed earlier to make sure that JSON results containing confidential data are only returned to your
own pages.
Second, your JSON response pages should only support POST requests, which prevents the script from being loaded via a script
tag.
Third, you should make sure that the script is not executable. The standard way of doing this is to append some non-executable prefix to
it, like ])}while(1);
Additional two:
There's a variation of JSON called JSONP which you should avoid using because it allows script injection by design.
And there's E4X (Ecmascript for XML) which can result in your HTML file being parsed as a script. Surprisingly, one way to protect
against E4X attacks is to put some invalid XML in your files, like the
above.
Watched a presentation: video, slides.
Is CSRF token enough to prevent XSSI attack?
Without appending non-executable prefix to response (e.g. as Facebook does with for(;;) or Google - )]}',\n ).
If not, how to perform XSSI attack when CSRF token in in place?

Answer 1

You care of this attack when :
1. Your site use dynamicJS.
2. And these pages contains personal data or secret token (csrf-token).
If so, use these following best practices:
1. Keep static script and content, separate with user data.
2. Use strict POST method, for JSON. (it can be bypassed).
3. Use CRSF tokens to verify before response.
So CSRF tokens are enough to secure but security recommends all best practices to be include.
Thanks,
Jaikey