Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance the CSRF tokens #25

Closed
camfindlay opened this issue Jul 13, 2019 · 4 comments
Closed

Enhance the CSRF tokens #25

camfindlay opened this issue Jul 13, 2019 · 4 comments

Comments

@camfindlay
Copy link
Contributor

Look to amend our tokens using the approach put forward at https://github.com/qld-gov-au/ckan-ex-qgov/pull/6/files
@ThrawnCA
Copy link
Contributor

Description is at #23 (comment)

@ThrawnCA
Copy link
Contributor

ThrawnCA commented Nov 8, 2019

Bump.

We've been running data.qld.gov.au and publications.qld.gov.au on the new HMAC-based token format for several months, and it seems to be working well.

@camfindlay
Copy link
Contributor Author

@ThrawnCA nice one! Take it we can close this issue?

@ThrawnCA
Copy link
Contributor

@camfindlay No, what I'm suggesting is that the HMAC-based token format from qld-gov-au/ckanext-qgov#6 should be merged into this extension. It can't just be cherry-picked, because things were restructured a bit when importing our CSRF filter into ckanext-security, but it should be pretty straightforward.

ThrawnCA added a commit to ThrawnCA/ckanext-security that referenced this issue Mar 8, 2020
@ThrawnCA
generate tokens with HMAC instead of random strings, data-govt-nz#25
65dcd75 
- This makes it almost impossible for an attacker to forge a token,
even if they find a way to set a cookie.
It also provides a verified timestamp so we can easily check the token age.
In future, it might even be possible to eliminate the cookie altogether,
so long as sufficient information is contained in the token,
eg username + timestamp + intended action.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@camfindlay @markstuart @ThrawnCA