Preventing CSRF attacks when using the cookie_session authenticator

[cameron-martin]

Oathkeeper doesn't seem to provide anything for CSRF protection when using the cookie_session authenticator. Should this be the concern of oathkeeper?

If it isn't the concern of oathkeeper, how does the app know whether it needs to verify CSRF tokens in the case there are multiple authentication methods where not all authentication methods require CSRF protection?

[aeneasr]

CSRF is an application concern, not of Oathkeeper. Authentication and CSRF are very distinct problems. The only crossover is that you generally want to refresh the CSRF cookie/token when a user logs out and freshly logs in.

[cameron-martin]

Thanks for clarifying.

[broncha]

@aeneasr So, I have a scenario where I have Kratos, an SPA (that handles the serf service), and a backend API server (which is totally stateless).
id token mutation in oathkeepr makes the API server open to CSRF attacks, as the session data is translated to valid JWT token.