It depends on if you're surfing on top of the wave, on a surfboard, or body-surfing in the wave. Both are technically correct, it's just a matter of how you're enjoying the surf.

Clidro – surfing term to describe a surfer turning up and down the face of the wave a surfer. Closeout – wave that suddenly breaks with no shape or shoulder. Clucked – a person who refuses to surf because he is scared of the waves. Cranking – near perfect waves. Crease – surfboard damage caused by an impact.

The act of surfing generally implies being on top of the water (wipeouts notwithstanding), so the preposition I'd use in this context is “on”. Contast this with swimming or scuba diving where one is immersed, for those I'd use “in”.

surf verb [I or T] (WAVES) to ride on a wave as it comes towards land, while standing or lying on a special board: They go surfing every weekend. See also. bodysurf.