search

hapijs / crumb

CSRF crumb generation and validation for hapi
Other
171 stars 50 forks source link

How does the check between the cookie and the header actually work? #120

Closed jd327 closed 5 years ago

jd327 commented 5 years ago

Thanks for the plugin, very useful.

Been looking at the source, just want to understand something: If the XHR request sends a cookie crumb=abc and a header X-CSRF-Token: abc, is it enough for validation to check if cookie equals the header, or is there some additional check to see if the value abc is actually valid?

spanditcaa commented 5 years ago

There isn't an additional check, the crumb value is randomly generated and there isn't any backend storage, nor hashing/signing algorithm used currently that could be used to validate the value.

jd327 commented 5 years ago

Thanks @spanditcaa. So the actual validation mechanism is just a check to compare that the cookie is the same as the header (which means it's a valid request)?

spanditcaa commented 5 years ago

Correct @ivanakimov. There is potential for enhancement. In addition to validating the value is legit I have seen other implementations that include a timestamp for expiry embedded in the crumb and set as the cookie lifetime - to prevent someone from capturing a crumb and then programatically making 100's of malicious requests.

jd327 commented 5 years ago

Right, makes sense. Yeah, that's why I wanted to double-check. Ok, thank you for the explanation @spanditcaa! 👍

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.