search

data-govt-nz / ckanext-security

A CKAN extension to hold various security improvements for CKAN
GNU Affero General Public License v3.0
25 stars 32 forks source link

fix static file requests regenerating CSRF token #15

Closed anotheredward closed 6 years ago

anotheredward commented 6 years ago

Previously every static file request, for example js,css,woff files would regenerate and update the CSRF token set in the cookie. This meant that if a user submitted a form before the page was finished loading, their CSRF token would be older than the one on the server and so the request would fail.

ebuckley commented 6 years ago

Code LGTM :shipit:

have not tested it out on my environment.

anotheredward commented 6 years ago

@ebuckley Can you think of any cases when we might want to provide a CSRF token on a response that is not html? I couldn't personally.

We're currently using the "set-cookie" strategy from this list: https://stackoverflow.com/questions/20504846/why-is-it-common-to-put-csrf-prevention-tokens-in-cookies