fix: resolve issue where CF cookies would mingle with CSRF detection …

…in API flows
ory · Mar 22, 2022 · 011219a · 011219a
1 parent 88ea06a
commit 011219a
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/selfservice/flow/request.go b/selfservice/flow/request.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	_ "embed"
 	"net/http"
+	"strings"
 
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/selfservice/strategy"
@@ -47,7 +48,17 @@ func EnsureCSRF(reg interface {
 			return errors.WithStack(ErrOriginHeaderNeedsBrowserFlow)
 		}
 
-		if len(r.Cookies()) > 0 {
+		// Workaround for Cloudflare setting cookies that we can't control.
+		var hasCookie bool
+		// - __cfasdf
+		for _, c := range r.Cookies() {
+			if !strings.HasPrefix(c.Name, "__cf") {
+				hasCookie = true
+				break
+			}
+		}
+
+		if hasCookie {
 			return errors.WithStack(ErrCookieHeaderNeedsBrowserFlow)
 		}
 

diff --git a/selfservice/flow/request_test.go b/selfservice/flow/request_test.go
@@ -30,6 +30,21 @@ func TestVerifyRequest(t *testing.T) {
 	require.EqualError(t, flow.EnsureCSRF(reg, &http.Request{
 		Header: http.Header{"Cookie": {"cookie=ory"}},
 	}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
+
+	// Cloudflare
+	require.NoError(t, flow.EnsureCSRF(reg, &http.Request{
+		Header: http.Header{"Cookie": {"__cflb=0pg1RtZzPoPDprTf8gX3TJm8XF5hKZ4pZV74UCe7"}},
+	}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
+	require.NoError(t, flow.EnsureCSRF(reg, &http.Request{
+		Header: http.Header{"Cookie": {"__cflb=0pg1RtZzPoPDprTf8gX3TJm8XF5hKZ4pZV74UCe7; __cfruid=0pg1RtZzPoPDprTf8gX3TJm8XF5hKZ4pZV74UCe7"}},
+	}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
+	require.Error(t, flow.EnsureCSRF(reg, &http.Request{
+		Header: http.Header{"Cookie": {"__cflb=0pg1RtZzPoPDprTf8gX3TJm8XF5hKZ4pZV74UCe7; __cfruid=0pg1RtZzPoPDprTf8gX3TJm8XF5hKZ4pZV74UCe7; some_cookie=some_value"}},
+	}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
+	require.Error(t, flow.EnsureCSRF(reg, &http.Request{
+		Header: http.Header{"Cookie": {"some_cookie=some_value"}},
+	}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
+	require.NoError(t, flow.EnsureCSRF(reg, &http.Request{}, flow.TypeAPI, false, x.FakeCSRFTokenGenerator, ""), flow.ErrCookieHeaderNeedsBrowserFlow.Error())
 }
 
 func TestMethodEnabledAndAllowed(t *testing.T) {