Increase the protection provided by the CSRF checks #2500
Conversation
| # should never appear in an URL as doing so is a security issue. We also | ||
| # explicitly check for request.POST here as we do not support sending form | ||
| # encoded data over anything but a request.POST. | ||
| if request.method == "POST": |
There was a problem hiding this comment.
request.POST can be used for any request that is uploaded using a form-encoding (multipart or urlencoded). A better check here would probably be if token in request.POST which will fail on any request where request.POST cannot be parsed.
There was a problem hiding this comment.
It is perfectly acceptable for a PUT request to have a body that is form encoded, thus a PUT request could have the CSRF token in request.POST.
This would be a b/w incompatible change.
There was a problem hiding this comment.
I originally did this because I was told that WebOb will copy the body on PUT requests if we unconditionally accessed request.POST and that was one of the reasons that this couldn't be done. However looking at the code now in WebOb it appears it will only do that if the Content-Type matches, so I think that is probably reasonable then.
There was a problem hiding this comment.
I had forgotten that was changed in WebOb, it used to do it unconditionally, but it was fixed because it would replace it with a FakeCGIBody, even on non form data.
dstufft
force-pushed
the
improve-csrf
branch
2 times, most recently
from
bad5333 to
9028dd1
Compare
|
👍 |
Previously `check_csrf_token` would allow passing in a CSRF token in through a the URL of a request. However this is a security issue because a CSRF token must not be allowed to leak, and URLs regularly get copy/pasted or otherwise end up leaking to the outside world.
Instead of only protecting against unsafe POST requests, have the automatic CSRF protect on all methods which are not defined as "safe" by RFC2616.
Instead of only checking on the CSRF on
POSTrequests, this will instead have the new, automatic CSRF checking occur on any HTTP method which is not defined as safe by RFC 2616.