Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi everyone! I'm setting up Hydra and what I'm struggling with is CSRF. I read the Hydra CSRF docs but there's not much info there. So the first question is, does Hydra create CSRF tokens/sets cookies itself or should I do it? Any help much appreciated

Hello <@U04T4CPFC1E>

Are you hosting Ory Hydra yourself?
What are you trying to achieve that caused the struggle with CSRF?

We do have some documentation here: <https://www.ory.sh/docs/self-hosted/hydra/debug/csrf>
Let me know if that helps.

Hi. What I mean is that when working with Kratos on frontend, Kratos sends you csrf tokens which you then send back and which Kratos then validates. And as far as I see there's no built-in csrf in Hydra (e.g. here <https://github.com/ory/hydra-login-consent-node> they use 3rd party csrf middleware)