3 ms·

"Whereupon I learned that Rails 2.3.11 changed the behavior of CSRF protection: instead of throwing exceptions, it would silently just clear the session and re-

by rlpb 15y ago

"Whereupon I learned that Rails 2.3.11 changed the behavior of CSRF protection: instead of throwing exceptions, it would silently just clear the session and re-run the request. For most sensitive operations (e.g. those which require a signed in user), this would force a signout and then any potentially damaging operation would be averted." Doesn't this change a CSRF attempt into a DoS? I don't understand the logic behind this change. Why not return an error response?

laughinghan 15y ago
How is this a DoS? It's not significantly more resource-intensive than any other request. If you could submit enough of these requests to DoS the server, you could submit enough of any request to DoS the server, so the server is no more vulnerable this way than otherwise.
- tedunangst 15y ago
  It allows you to grief the users of any rails site. You can log them out at will (for some value of at will). In the dawn of time, you could use a CSRF exploit and really grief the users. Then CSRF checking made that go away. This is now a step backwards, where 3rd party sites can affect your users.
  - subwindow 15y ago
    You can't log any arbitrary out of their sessions. It only resets your session, as in the session cookie is reset.
    - quotemstr 15y ago
      No, you, as an evil website operator, can cause anyone who visits your site to log out of any arbitrary rails site.
angelbob 15y ago
It seems like it would. The security advisory made it seem like the way they were returning an error was inadequate - perhaps there was an insecurity with cookie stuff being sent back? But yeah, this seems like too big a hammer to fix that problem...