syncrypt / client

Syncrypt command line client and sync daemon
https://syncrypt.space
GNU General Public License v3.0
11 stars 1 forks source link

Make sure Syncrypt is not vulnerable to CSRF attack #8

Closed lordi closed 8 years ago

lordi commented 8 years ago

Locally bound HTTP RPC services can be called from the browser if no measure are taken against it.

Here is an example of Monero:

https://labs.mwrinfosecurity.com/advisories/csrf-vulnerability-allows-for-remote-compromise-of-monero-wallets/

The temporary solution of Monero is to set a pre-defined user agent, but that does not seem secure enough. We probably need some simple authentication token for API calls.