Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93185
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZbpdaHDakds6-K-rEjO+zcS9oWuVoD24WBxFDs9-ZJRQ@mail.gmail.com>
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
 <c21d1d4b-a790-e1a9-7c93-2c5af4baf5d1@gmail.com> <CAGa2bXboop3KDFnYtcdO-K+hL0To5te_yeHeFEFO-kCVuzNOJQ@mail.gmail.com>
 <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com> <CAGa2bXZwRK0GuXbT53B4w+h5ySiVJnJpo-d87Uiw-reYHi80zQ@mail.gmail.com>
 <fc0c78c6-744e-08bb-5ed2-b957458ea3e0@gmail.com> <CAGa2bXZbpdaHDakds6-K-rEjO+zcS9oWuVoD24WBxFDs9-ZJRQ@mail.gmail.com>
Date: Tue, 10 May 2016 21:20:52 -0400
Message-ID: <CAF+u_Bz4f6CY0Cq9LA6Up8kC5NkN77uM=PD9AR3U2dO7ePwEjQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113a6c04742f8e053286db2a
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: kinncj@gmail.com (=?UTF-8?B?S2lubiBKdWxpw6Nv?=)

--001a113a6c04742f8e053286db2a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

> JS code that does not have pages at all may obtain CSRF token manually.

That's against CSRF protection... in fact, a remote app can obtain the
token also and make the cross site request forgery...

-1

On Tue, May 10, 2016 at 9:17 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Stas,
>
> On Wed, May 11, 2016 at 7:58 AM, Stanislav Malyshev <smalyshev@gmail.com>
> wrote:
> >>> Add where? And where that value would come from? RFC says nothing abo=
ut
> >>> that.
> >>
> >> As usual. Query parameter when GET is used. Additional input when POST
> >> is used. All users have to do is adding CSRF token to JS program.
> >
> > GET and POST aren't the only HTTP methods. And where JS program would
> > get the correct token from? As far as I can see, there's no function in
> > the RFC that produces it.
>
> JS code that does not have pages at all may obtain CSRF token manually.
>
> get_csrf_token.php
> <?php
> session_start(['csrf_protection'=3D>SESSION_CSRF_GET]);
> echo json_encode(['SESSCSRF'=3D>SESSCSRF]);
> ?>
>
> then JS apps may use the token. Users must be careful for CSRF token TTL.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


--=20
*--*
*Kinn Coelho Juli=C3=A3o*
*Toronto - ON/Canada*

--001a113a6c04742f8e053286db2a--