Uploaded image for project: 'Magnolia'
  1. Magnolia
  2. MAGNOLIA-8210

Review CSRF filter implementations and bypasses

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Done
    • Neutral
    • 6.2.14
    • 6.2.12
    • core
    • Yes
    • Yes

    Description

      After reviewing the CSRF concept in Magnolia, we concluded couple solutions:

      In MAGNOLIA-8209 (just FYI here):

      • First, reduce the amount of cookies generated for every requests. Tentatively recycle the cookie name (sub-domain only), and update its value?

      In this ticket:

      • Reconsider applying the token generation to everything, unless the Form loginHandler's allowedMethods includes GET (disabled by default since MAGNOLIA-8115).
      • Split implementation of synchronizer-pattern vs. double-submit cookie pattern into two CSRF filters, with their own bypasses.

      See SUPPORT-13766 for the original bug report.
      As QA we should verify the solution also positively impacts the amount of cookies/headers size.

      Checklists

        Acceptance criteria

        Attachments

          Issue Links

            clones

            Bug - A problem which impairs or prevents the functions of the product. MAGNOLIA-8209 CSRF Header sent with all responses

            • Major - Major loss of function, or significant new/changed feature
            • Closed
            relates to

            Task - A task that needs to be done. MAGNOLIA-8226 DOC: Update CSRF filter implementation

            • Neutral -
            • Closed
            split to

            Improvement - An improvement or enhancement to an existing feature or task. MAGNOLIA-8232 Intercept login redirects to reduce bypasses for the login-CSRF filter

            • Neutral -
            • Accepted
            to be documented by

            Task - A task that needs to be done. MAGNOLIA-8226 DOC: Update CSRF filter implementation

            • Neutral -
            • Closed
            mentioned in

            Page Loading...

            Activity

              People

                mduerig Michael Duerig
                mgeljic Mikaël Geljić
                Votes:
                0 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  Checklists

                    Task DoD