Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:93244 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 74062 invoked from network); 11 May 2016 15:41:25 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 11 May 2016 15:41:25 -0000 Authentication-Results: pb1.pair.com header.from=narf@devilix.net; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=narf@devilix.net; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.45 as permitted sender) X-PHP-List-Original-Sender: narf@devilix.net X-Host-Fingerprint: 209.85.218.45 mail-oi0-f45.google.com Received: from [209.85.218.45] ([209.85.218.45:35730] helo=mail-oi0-f45.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 1E/5F-28272-4A253375 for ; Wed, 11 May 2016 11:41:25 -0400 Received: by mail-oi0-f45.google.com with SMTP id x19so73941888oix.2 for ; Wed, 11 May 2016 08:41:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=devilix.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=+ykBjhjFHEzZkSKG8GZHUUdDcHqo1ENn0uxW/fVEVyk=; b=aHpxli5JGRJ6mBk10Vv5B/9cUGm9DfK5fvRmUTuBsqYMeQdr1+eW5oJW0iijgYAz5k IxhWedibhgFb5pOOa6n39TvV57pGlioSkCAwMjmDwUMOh6oydSe+1YhTXxQI6Mp2z1Lu 21u+N9c+wmnMh5GqP4cbPt+O/kBm0qeiSDy0I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=+ykBjhjFHEzZkSKG8GZHUUdDcHqo1ENn0uxW/fVEVyk=; b=g3Iw5bjLU4HzLLGx/zgHtb9nj5iUxBA9OWEkBOCeCawsa7XZPsO7cPzrGouKDRz+nr b4QACNl6S6MuwjllH5/LaruBwaF/VgWaKDYIf3RRE/vHnaE602KCPNyZsf/P+hzLcUgo Rjgu/W1OKRJxAntgyHKK7EPTtFpzCYZ7Y93dJYMh4fIPp/oxch6SkfCOxn5fJCvDaXuv xavZJai9ue8uYhdtGGM2Yu6NVMQdHlBL6Sebi3LU/cIi5qocgYL/9uyBWuSIz4bX4Az+ JN4ZddkD9hALJWbyALqE/vwJhYNTvtRZ/pkK5TiVgoCBZSXW251SS+OS/X9f5D8fl6La hACQ== X-Gm-Message-State: AOPr4FU3aNZAnjFjiztb/ePFL9mSgaLMHoeM218bjyBkrwsVOxRWR7mlbBvvh3gJIV9ojvzRzDd3GrPvOudPuw== MIME-Version: 1.0 X-Received: by 10.157.9.215 with SMTP id 23mr2626704otz.94.1462981281732; Wed, 11 May 2016 08:41:21 -0700 (PDT) Received: by 10.202.175.147 with HTTP; Wed, 11 May 2016 08:41:21 -0700 (PDT) In-Reply-To: <573345AF.9020206@lsces.co.uk> References: <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com> <4667bb84-4401-4dd6-6193-fcf3aa6b3d48@gmail.com> <4d97846f-81d6-6cad-91ad-5e513a709e91@gmail.com> <573345AF.9020206@lsces.co.uk> Date: Wed, 11 May 2016 18:41:21 +0300 Message-ID: To: Lester Caine Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a113d777a9c7925053292df4f Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection From: narf@devilix.net (Andrey Andreev) --001a113d777a9c7925053292df4f Content-Type: text/plain; charset=UTF-8 On Wed, May 11, 2016 at 5:46 PM, Lester Caine wrote: > On 11/05/16 14:40, Andrey Andreev wrote: > > Therefore, while the session store *after login* is suitable for token > > storage, CSRF protection by default just doesn't belong in ext/session. > > If I am using php simply to 'add detail' to an element of a page that > does not require the client to be logged in then I don't see any ned to > enable CSRF, but one of the options on that anonymous guest page may > well be a login button. Surely a large percentage of php traffic does > not need any security, only DoS filtering? UNTIL one is identified one > does not need a secure connection? Although I can see that some people > would want to ensure that anonymous content was 'secure', but isn't that > the job of https? > > Your login form too needs CSRF protection. It's a chicken and egg problem. A lot could be written on the rest of your comments, but they are not relevant to the RFC. Cheers, Andrey. --001a113d777a9c7925053292df4f--