search

starlightprivate / flash2

nodejs app
0 stars 0 forks source link

Fix xsrf #259

Closed vodolaz095 closed 7 years ago

vodolaz095 commented 7 years ago

  1. Enable XSRF-TOKEN cookie. Becasue if we had this vulnerability used, there would be ~ 1000 API calls in loggly every few minutes. See loggly - nothing like this

  2. Log CSRF token errors to loggly too, it can be educative.

This change is Reviewable

vodolaz095 commented 7 years ago

related issue - https://detectify.com/report/fb7ade923fbe837098884177e004efda/1d5d7afd3fbfa44fea01489e86a4dd2a58c149d5/43f037ac-e638-4703-b3df-a3b27087b9c6

but as i have said, it is not used, no 10k api calls in loggly!!!! And, using cookie like this will more likely result in 10k entries in Bot Punished By {enterMiddlewareNameHere}

vodolaz095 commented 7 years ago

we need to reenable this to fix errors like this sentry one https://sentry.io/starlight-group/frontend/issues/244859893/