-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
๐๏ธ Protect against CSRF attacks (#5)
* ๐๏ธ Protect against CSRF attacks CORS and the JSON API heavily reduced the attack surface here, but especially the upload endpoints were still vulnerable to CSRF attacks. All endpoints on the API that use methods beyond GET, HEAD or OPTIONS now require the presence of a csrf token (generated by the UI on first load) AND a X-CSRF-Token header with a matching value (Double Submit Cookie), unless authorization is done through an API-Key instead of a browser session. Additionally, the SameSite attribute now is set to "Strict" by default. * ๐๏ธ Expand CSRF protection to plugins Plugins are currently by default *opted out* of CSRF protection, to ensure backwards compatibility with third party plugins in the field. However, in a future OctoPrint version this will become a default *opt in*. Plugin authors are advised to adjust the implementation with an explicit decision via a logged warning generated in the default implementation. Additionally, plugins that have opted out their whole plugin will generate a warning in the startup messages. A decorator to exempt individual endpoints from CSRF protection as certain workflows require (see for example the auth request in the appkeys plugin) is provided. The general rule of thumb should be to opt in and only exempt those non GET/HEAD/OPTIONS endpoints that really need to be usable without an API key or CSRF cookie/header combo. In practice, that should be pretty much non. * ๐ Fix a left-over from a local test * ๐ Fix wrong setting in E2E test config.yaml * ๐งโ๐ป Set CSRF header for $.ajax as well We already ensure the header is set in the client lib and on the file upload widgets, but many third party plugins don't use the client lib but rather $.ajax directly and thus break without this. * ๐ Improve docs on CSRF protection
- Loading branch information
Showing
22 changed files
with
402 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.