AppSec Europe 2018

Xing is a European career-oriented social networking platform. While appearing as a single website to the visitors, internally it's more than a hundred of separate web applications interacting with each other, most of them built using Ruby on Rails.
We discovered that the Rails' built-in CSRF prevention mechanism doesn't work between multiple applications and causes too many exceptions affecting the visitors when combined with single page application frameworks like React.
 In the first part of the talk we'll explore the problems arising from applying a CSRF protection built for classic monolithic web applications to a single page application and microservice architecture. The second part is a detailed description of the alternative language agnostic self-recovering CSRF prevention mechanism we developed to address the issues, followed by a live demo.