JWT for CSRF protection on unauthenicated endpoints?

Question

I have a load of api endpoints that I want to protect from CSRF. I'd like to do this in a stateless way, so naturally JWT comes to mind.

The problem is, these endpoints do not require the user to be logged in.

So, my problem is, I can use JWT, but I have no way of verifying the token on the server side -- I have no logged in user I can match it to.

Is there any way JWT can be used in such cases?

Answer 1

CSRF is only a problem for requests where the browser implicitly authenticates the request (cookies or basic authentication). But if you do not have any authentication, any site could potentially call your API.

So if I understand you correctly, you are looking for a way to make sure that the request to your API is coming from your web application.

Take a look at the client credentials grant in OAuth 2.0. It basically issues a token to authenticate the application instead of the user.