In addition to CSRF token, verify the origin too #2501
Conversation
dstufft
force-pushed
the
check-origin-csrf
branch
from
70f48e4
to
815f001
Compare
|
|
||
| Note that this function will do nothing if request.scheme is not https. | ||
|
|
||
| ..versionadded:: 1.7 |
There was a problem hiding this comment.
IIRC you need one more space after the initial two periods.
dstufft
force-pushed
the
check-origin-csrf
branch
from
815f001
to
67f4a0f
Compare
dstufft
changed the title
| ) | ||
|
|
||
| from pyramid.exceptions import BadCSRFToken | ||
| from pyramid.exceptions import BadCSRFOrigin, BadCSRFToken |
There was a problem hiding this comment.
I would prefer these on multiple lines, with tuple style importing, listed in alphabetical order.
dstufft
force-pushed
the
check-origin-csrf
branch
2 times, most recently
from
a5e56b8
to
6eae953
Compare
|
Ok, unless code review finds something that needs addressed I think this should be ready to merge! |
|
👍 @mmerickel I don't believe that adding this will break anything for anyone, and I've compared it against the Django version and it is similar (and has the same effect). Would like your sign-off too before merging this :-). |
dstufft
force-pushed
the
check-origin-csrf
branch
from
6eae953
to
a0992c6
Compare
| @@ -101,6 +108,77 @@ def signed_deserialize(serialized, secret, hmac=hmac): | |||
|
|
|||
| return pickle.loads(pickled) | |||
|
|
|||
|
|
|||
| def check_csrf_origin(request): | |||
There was a problem hiding this comment.
I would like to see this function more reusable in a similar vein to check_csrf_token. For example a default signature like check_csrf_origin(request, trusted_origins=None, raises=True) where trusted_origins overrides the usage of the setting.
|
Not very happy about all the whitespace changes here. It made this significantly more tedious to review and github's little |
|
Found a couple issues in comments but otherwise the feature looks good. |
dstufft
force-pushed
the
check-origin-csrf
branch
from
a0992c6
to
d5e8b50
Compare
Add an additional layer of protection against CSRF by verifying the actual origin of the request in addition to the CSRF token. We only do this check on sites hosted behind HTTPS because only HTTPS sites have evidence to show that the Referrer header is not being spuriously removed by random middleware boxes.
dstufft
force-pushed
the
check-origin-csrf
branch
from
d5e8b50
to
65dee6e
Compare
|
Ok. I adjusted this to take into account the feedback and the tests are passing again. |
|
Nice, thank you! |
Add an additional layer of protection against CSRF by verifying the actual origin of the request in addition to the CSRF token. We only do this check on sites hosted behind HTTPS because only HTTPS sites have evidence to show that the Referrer header is not being spuriously removed by random middleware boxes.
Note, to prevent any sort of backwards incompatibilities and since the CSRF predicate has been deprecated, I've only added this to the new view derivation form of CSRF.
I still need to write documentation and tests (working on that now), just thought I'd throw this up here incase people were interested. This is same technique can be seen in Django.