eclipse-pass / main

Catch all repository against which issues of general, cross cutting topics are logged.
Apache License 2.0
4 stars 8 forks source link

Enable CSRF protection in pass-core #957

Closed markpatton closed 5 months ago

markpatton commented 7 months ago

What?

The builtin spring security CSRF protection should be enabled. This will require updates to pass-ui and the pass-support data client as well.

Why?

PASS is vulnerable to Cross-Site Request Forgery attacks without proper mitigation.

How?

Enable the disable CSRF protection in pass-core-main. Then fix tests. Then update the data client in pass-support to handle the token. Finally update pass-ui for the token.

Acceptance Criteria

All tests should pass with CSRF protection enabled.

Related Issues

Blocked by #903