search

commercetools / commercetools-sunrise-java

The next generation shop framework by commercetools
https://demo.commercetools.com
Apache License 2.0
46 stars 35 forks source link

Check that all mutations are done Get-Post-Redir with csrfToken #587

Open nkuehn opened 7 years ago

nkuehn commented 7 years ago

Before releasing a 1.0 it would be reassuring to have done a review that the security related patterns like e.g. csrf and HTTP flow via get-post-redirect are consistently done in all places, especially the checkout.

maybe other important security related reviews, too?

lauraluiz commented 7 years ago

This is for sure done everywhere. There is a CSRF filter that forces the token everywhere and Sunrise forces to deal with what happens in case of success on the form handling, which by default in Sunrise Starter is redirection. I will anyway leave this open to do a last check when the time comes.

Looking forward suggestions on other security checks :)

nkuehn commented 7 years ago

quite a while ago partner pointed out to me that there's a place in the checkout that does not do get-post-redirect. But that's long ago.

This was really just intended as a pre-1.0 reminder. Releasing with obvious security holes is a pretty nice PR desaster.