search

philloooo / github-tests

just for testing various github features/bugs
Apache License 2.0
0 stars 0 forks source link

PXD-274 ⁃ Fence is not checking origin/Referer for csrf #296

Open skattar1406 opened 6 years ago

skattar1406 commented 6 years ago

Just read through this post The end of that post has a good run through in java.

We are missing step 1, verifying the origin url. And should be able to gleam the information from one/multiple of these

skattar1406 commented 6 years ago

➤ Justin Barnowski commented:

Here's an example: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)#Prevention_measures_that_do_NOT_work

skattar1406 commented 6 years ago

➤ Justin Barnowski commented:

@philloooo

Since @jesuspguofc were asking about it. Read the link from March

skattar1406 commented 6 years ago

➤ Justin Barnowski commented:

https://github.com/uc-cdis/fence/pull/209/files#diff-feb6ac6f84a84b339e1cd1e1fc97e3daR193 ^ All I need to do to get around CSRF currently is have a header named Authorization, doesn't even have to be valid.... Trivially bypassed.