Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

portal-api: Bypass CSRF protection for login route #340

Merged
merged 1 commit into from
Aug 20, 2024
Merged

portal-api: Bypass CSRF protection for login route #340

merged 1 commit into from
Aug 20, 2024

Conversation

selfhoster1312
Copy link
Contributor

@selfhoster1312 selfhoster1312 commented Aug 14, 2023 •
edited
Loading

Allowing login from simple HTML form
Also allow to pass username/password as two params instead of a combined "credentials"

Demo using my_webapp:

<!DOCTYPE html>
<html>
  <head>
    <title>Yunohost SSO</title>
  </head>
  <body>
<?php
    if (array_key_exists("REMOTE_USER", $_SERVER) && $_SERVER["REMOTE_USER"] != "") {
        echo "Welcome, " . $_SERVER["REMOTE_USER"] . "!";
        echo "<br><a href='/yunohost/portalapi/logout?referer_redirect'>Log out<br>";
    } else {
?>
    <form method="POST" action="/yunohost/portalapi/login?referer_redirect">
        <input type="text" name="username" id="username">
        <br><input type="password" name="password" id="password">
        <br><input type="submit">
    </form>
<?php
    }
?>
  </body>
</html>

@selfhoster1312
Bypass CSRF protection for the /yunohost/portalapi/login route
7daa504 
Allowing login from simple HTML form
Also allow to pass username/password as two params instead of a combined "credentials"
@selfhoster1312 selfhoster1312 mentioned this pull request Aug 14, 2023
Closed
@alexAubin alexAubin changed the base branch from boring-login-api to portal-api August 15, 2023 10:55
@selfhoster1312 selfhoster1312 changed the title Bypass CSRF protection for the /yunohost/portalapi/login route portal-api: Bypass CSRF protection for login route Aug 15, 2023
alexAubin
alexAubin reviewed Sep 27, 2023
View reviewed changes
moulinette/interfaces/api.py
@@ -272,13 +272,14 @@ def setup(self, app):
name="login",
method="POST",
callback=self.login,
skip=["actionsmap"],
skip=[filter_csrf, "actionsmap"],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm kinda confused ... I understand that basic, "raw" HTML form won't include the special X-Requested-With header ... but it looks like disabling this checks opens up the very security issue that this CSRF is supposed to prevent ... or would a CSRF token help fix the "raw" HTML form support, rather than relying only on X-Requested-With ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding: CSRF is a problem where you steal credentials from an authenticated user from another webpage. On the login/logout route, it should not have any security implications.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alrighty:

Definition. Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated.

@alexAubin alexAubin deleted the branch YunoHost:bookworm September 27, 2023 16:55
@alexAubin alexAubin closed this Sep 27, 2023
@alexAubin alexAubin reopened this Sep 27, 2023
@alexAubin alexAubin changed the base branch from portal-api to bookworm September 27, 2023 17:48
@selfhoster1312
Copy link
Contributor Author

About CSRF in general, it's desirable to protect from such attacks. However, a header token is not the only approach.

For actions where the user should be logged in, we can:

  • generate a unique token server side to be provided in the HTML form, what's apparently called synchroniser token pattern ; not sure how effective that is, can't the attacker just read the token by making a request for the form first?
  • set a stricter cookie policy ; currently Yunohost uses samesite=lax so that the user is not authenticated at all in case of CSRF

About the cookie policy, is it lax only because SSOWat needs to handle different domains? If so maybe we could workaround by having a cookie per SSOWat domain?

@alexAubin alexAubin merged commit 0d7a143 into YunoHost:bookworm Aug 20, 2024
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@alexAubin alexAubin alexAubin left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@selfhoster1312 @alexAubin