Suggestion: Better CSRF error handling (triggered with HttpOnly cookies and HTTP Header authentication)
@iglocska is already working on this.
Since Sep 3, 2024.
Assessment
This issue has not been assessed yet.
Description
This is a (multiple allowed):
-
bug
-
enhancement
-
feature-discussion (RFC)
-
CakePHP Version: c31bb4b - the latest version used in MISP
-
Platform and Target: Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux
What you did
HttpOnly session cookies were implemented in our MISP installation. This installation also used authentication headers (SAML2 with mellon plugin).
As a consequence, the page to "populate from " ... " Freetext import" loaded.
When submitting the attribute, the page fails with The request has been black-holed - CSRF token mismatch
What happened
We searched a lot on the MISP issue page on github and found no similar issues.
We debugged the code trying to understand the error.
We dumped the data at this place:
https://github.com/MISP/cakephp/blob/c31bb4b4be00d2a0db22c9a038f9fad8a5950efe/lib/Cake/Controller/Component/SecurityComponent.php#L776
the $token appears to be null
As a consequence, the code goes here https://github.com/MISP/cakephp/blob/c31bb4b4be00d2a0db22c9a038f9fad8a5950efe/lib/Cake/Controller/Component/SecurityComponent.php#L784 and the CSRF error is triggered.
Indeed, the POST is triggered by jquery and because the session cookie in HttpOnly, the jquery code cannot access it.
Because we are using authentication headers for authentication, it reuse the authentication headers to create a new session and the CSRF code cannot work with 2 sessions instead of one.
What you expected to happen
What would have save a lot of time for us is a better error message.
We can see here a defensive programming check for requesttoken:
https://github.com/MISP/cakephp/blob/c31bb4b4be00d2a0db22c9a038f9fad8a5950efe/lib/Cake/Controller/Component/SecurityComponent.php#L779-L782
But nothing for token.
Maybe do something like:
if (!$token) {
throw new SecurityException('No CSRF token found stored in session. Old session or HttpOnly Cookie ?');
}
- Dominant language
- PHP
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Automattic/static-site-importer#1879 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
521xueweihan/HelloGitHub#3790 ·
-
[Bug] Feed date, title and author too long to fit inside article box on smaller screens, mobileOpenBug (unconfirmed) Good first issue 1️⃣ help wanted UI :art:
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
FreshRSS/FreshRSS#9360 · 2 comments ·
Maintainers usually reply within 1 day