Open solventt opened 2 years ago
HMAC Based Token Pattern and Encryption based Token Pattern were removed.
No. See the following paragraph:
A simpler alternative to an encrypted cookie is to HMAC the token with a secret key known only by the server and place this value in a cookie. This is similar to an encrypted cookie (both require knowledge only the server holds), but is less computationally intensive than encrypting and decrypting the cookie. Whether encryption or a HMAC is used, an attacker won't be able to recreate the cookie value from the plain token without knowledge of the server secrets.
But overall thanks for giving a link. Seems the guide was updated.
In the documentation you refer to OWASP: now only
Synchronizer Token Pattern
andDouble Submit Cookie
are actual there.HMAC Based Token Pattern
andEncryption based Token Pattern
were removed.It should be understood that the
Double Submit Cookie
will require the configuration to useYiisoft\Cookies\CookieMiddleware
.But maybe you shouldn't add the
Double Submit Cookie
pattern, because it seems to me that this thing is for rare use.Steps to update:
1) To remove
HMAC Based Token Pattern
2) To addDouble Submit Cookie
processing logic to the middleware (optional) 3) To write something likeDoubleSubmitCsrfToken
(optional) 4) To update the documentationDraft with the
Double Submit Cookie
pattern :Why are checks made before the
validateCsrfToken
method? OWASP requires the cookie to be set the first time the user visits the site: "When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudorandom value and set it as a cookie on the user's machine separate from the session identifier."