Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93150
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.47 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
 <e9b34da1-a6c7-261e-1a83-9bf34d2ed8ac@gmail.com>
 <CAGa2bXZp5HavxNw6ZFk0RnOc2HvAtukLz2mnT8FC_UE8O9PNmw@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <e607488b-6825-19c3-94dd-5e29bdb45649@gmail.com>
Date: Tue, 10 May 2016 08:30:54 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0)
 Gecko/20100101 Thunderbird/45.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZp5HavxNw6ZFk0RnOc2HvAtukLz2mnT8FC_UE8O9PNmw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> To protect all of URLs automatically, all URLs need to have token.
> That's the reason why all URLs have token. The risk is the same as
> Trans SID session management.

But not all URLs need protecting. There are a lot of URLs that do not
need protecting - and there are a lot of actions, especially in modern
web application, that aren't achieved by simply clicking the link in the
browser. Modern web application is usually a combination of backend and
frontend logic, and if you have any frontend logic driven by XHR or
such, URL rewriting is not going to work.

> Because of  likelihood of the vulnerability, it's better provide basic
> infrastructure. IMO. It's possible to give more control to users.

The problem is the RFC proposes to give less control to users - namely,
the defaults proposed are likely to break an average application *and*
not provide CSRF protection for it.

-- 
Stas Malyshev
smalyshev@gmail.com