Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggestion: Better CSRF error handling (triggered with HttpOnly cookies and HTTP Header authentication) #2

Open
1 of 3 tasks
vletoux opened this issue Mar 20, 2023 · 0 comments
Assignees

Comments

@vletoux
Copy link

vletoux commented Mar 20, 2023

This is a (multiple allowed):

  • bug

  • enhancement

  • feature-discussion (RFC)

  • CakePHP Version: c31bb4b - the latest version used in MISP

  • Platform and Target: Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux

What you did

HttpOnly session cookies were implemented in our MISP installation. This installation also used authentication headers (SAML2 with mellon plugin).

As a consequence, the page to "populate from " ... " Freetext import" loaded.
When submitting the attribute, the page fails with The request has been black-holed - CSRF token mismatch

What happened

We searched a lot on the MISP issue page on github and found no similar issues.

We debugged the code trying to understand the error.
We dumped the data at this place:

$token = $this->Session->read('_Token');

the $token appears to be null

As a consequence, the code goes here

throw new SecurityException('CSRF token mismatch');
and the CSRF error is triggered.

Indeed, the POST is triggered by jquery and because the session cookie in HttpOnly, the jquery code cannot access it.
Because we are using authentication headers for authentication, it reuse the authentication headers to create a new session and the CSRF code cannot work with 2 sessions instead of one.

What you expected to happen

What would have save a lot of time for us is a better error message.

We can see here a defensive programming check for requesttoken:

if (!$requestToken) {
throw new SecurityException('Missing CSRF token');
}

But nothing for token.
Maybe do something like:

if (!$token) {
	throw new SecurityException('No CSRF token found stored in session. Old session or HttpOnly Cookie ?');
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants