Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF protection #226

Merged
merged 2 commits into from
Jun 29, 2020
Merged

CSRF protection #226

merged 2 commits into from
Jun 29, 2020

Conversation

liangyuanruo
Copy link
Contributor

@liangyuanruo liangyuanruo commented Jun 29, 2020 •
edited by jimvae
Loading

Problem

Application is vulnerable to CSRF.

Solution

Ensure that the session cookie is not sent when the user visits other domains, by setting the SameSite attribute to strict.

Additionally, removed unnecessary custom middleware setting Access-Control-Allow-Methods and set cross-fetch options from cors to same-origin.

Tests

  • Link shortening creation and modification
  • File upload creation and modification
  • Session cookie is no longer attached from cross-domain requests

LoneRifle
LoneRifle approved these changes Jun 29, 2020
View reviewed changes
Copy link
Contributor

@LoneRifle LoneRifle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, although... does this influence whether we can expose a RESTful API?

@liangyuanruo liangyuanruo merged commit 0aea781 into develop Jun 29, 2020
@liangyuanruo liangyuanruo deleted the security branch June 29, 2020 14:34
LoneRifle pushed a commit that referenced this pull request Jun 30, 2020
@liangyuanruo @LoneRifle
feat: add CSRF protection (#226)
cb00700 
* fix(auth): set cookie to use sameSite attribute and prevent CSRF
* refactor(network): remove custom middleware injecting preflight headers
@snyk-bot snyk-bot mentioned this pull request Nov 23, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LoneRifle LoneRifle LoneRifle approved these changes

@yong-jie yong-jie Awaiting requested review from yong-jie

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@liangyuanruo @LoneRifle