vriska/hydra
0
0
Fork 0
forked from lix-project/hydra
Code Pull requests Activity

Add XSRF protection for POST requests

Browse source 
Some Hydra API requests were vulnerable to XSRF attacks, e.g. you
could have a form on another website using http://hydra/logout as the
form action. So we now require POST requests to come from the same
origin.

Reported by Hans-Christian Esperer.
This commit is contained in:
Eelco Dolstra 2016-10-20 16:11:33 +02:00
parent bbe45ed844
commit c928c41ee1
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/lib/Hydra/Controller/Root.pm
View file

@ -60,6 +60,15 @@ sub begin :Private {
};
$_->supportedInputTypes($c->stash->{inputTypes}) foreach @{$c->hydra_plugins};
# XSRF protection: require POST requests to have the same origin.
if ($c->req->method eq "POST") {
my $referer = $c->req->header('Origin');
$referer //= $c->req->header('Referer');
my $base = $c->req->base;
error($c, "POST requests should come from ‘$base’")
unless defined $referer && $referer eq $base;
}
$c->forward('deserialize');
$c->stash->{params} = $c->request->data or $c->request->params;