4 ms·

The comments mention this is also a problem with Django's CSRF cookie when using GA?

by welder 11y ago

marcosdumay 11y ago
The default Django CSRF protection is based on a hidden field, not cookies. Thus, the default mechanism does not have this flaw. One can always replace it with something that is vulnerable, so there are probably Django sites out there with this problem. But if you never thought deeply about it, your site is fine... What's a feature that I really love about Django, you'll see that same same phrase "if you never thought deeply about it, your site is fine" for lots and lots of security problems. What I don't get is how is it possible to do CSRF with cookies? Aren't cookies always shared between simultaneous browsers sessions? Isn't the entire point of CSRF to avoid that?
- elithrar 11y ago
  > The default Django CSRF protection is based on a hidden field, not cookies. This is not true. The default Django CSRF protection uses cookies for the session store[1] > What I don't get is how is it possible to do CSRF with cookies? The same as any other CSRF mechanism :) 1. You provide the user a (preferably per-request vs. BREACH) token, often in a hidden form field. The field being hidden is primarily for UX reasons. 2. You store a copy of that token in a session store. This is often a cookie due to the convenience of cookies (no server state required), but can be in a server-side store (memory, Redis, RDBMS, et. al). 3. Upon any non-idempotent HTTP method (anything that's not GET/HEAD/OPTIONS) you compare the token in the submitted form to the value stored in the session. The benefits are that you don't have to maintain server state. The downside is that you're transmitting your token over a channel at risk of MITM. Using authenticated cookies helps as any attempt to modify both the form value AND cookie value (i.e. so they match) should fail when you verify the MAC on form submission. By default, Django's cookies are authenticated. [1] https://github.com/django/django/blob/master/django/middleware/csrf.py https://github.com/django/django/blob/master/django/middlewa...

The comments mention this is also a problem with Django's CSRF cookie when using GA?

by welder 11y ago

The comments mention this is also a problem with Django's CSRF cookie when using GA?

The default Django CSRF protection is based on a hidden field, not cookies. Thus, the default mechanism does not have this flaw. One can always replace it with something that is vulnerable, so there are probably Django sites out there with this problem. But if you never thought deeply about it, your site is fine... What's a feature that I really love about Django, you'll see that same same phrase "if you never thought deeply about it, your site is fine" for lots and lots of security problems. What I don't get is how is it possible to do CSRF with cookies? Aren't cookies always shared between simultaneous browsers sessions? Isn't the entire point of CSRF to avoid that?

elithrar 11y ago
> The default Django CSRF protection is based on a hidden field, not cookies. This is not true. The default Django CSRF protection uses cookies for the session store[1] > What I don't get is how is it possible to do CSRF with cookies? The same as any other CSRF mechanism :) 1. You provide the user a (preferably per-request vs. BREACH) token, often in a hidden form field. The field being hidden is primarily for UX reasons. 2. You store a copy of that token in a session store. This is often a cookie due to the convenience of cookies (no server state required), but can be in a server-side store (memory, Redis, RDBMS, et. al). 3. Upon any non-idempotent HTTP method (anything that's not GET/HEAD/OPTIONS) you compare the token in the submitted form to the value stored in the session. The benefits are that you don't have to maintain server state. The downside is that you're transmitting your token over a channel at risk of MITM. Using authenticated cookies helps as any attempt to modify both the form value AND cookie value (i.e. so they match) should fail when you verify the MAC on form submission. By default, Django's cookies are authenticated. [1] https://github.com/django/django/blob/master/django/middleware/csrf.py https://github.com/django/django/blob/master/django/middlewa...