CSRF Protection

[chrisdpeters]

If all goes well with our CSRF Protection plugin, we may want to implement this for the next major release.

Suggested task list if we decide to go forward with this:

• Integrate into core
• Add call to protectFromForgery to default controllers/Controller.cfc file included in framework zip
• Add call to csrfMetaTags to default views/layout.cfm file included in framework zip
• Write tests
  • Write tests for including token as X-CSRF-Token HTTP header
• Write documentation
  • protectFromForgery
  • csrfMetaTags
  • authenticationTokenField
  • Upgrading - add protectFromForgery to controllers/Controller.cfc, add csrfMetaTags to layouts, configure AJAX calls to post with X-CSRF-TOKEN HTTP header
• Add config settings for storing authenticityToken in session (default) or encrypted cookie
  • Implement in plugin first (Allow CSRF token to be stored in its own encrypted cookie liquifusion/cfwheels-csrf-protection#4)
  • Document new csrf* settings in Configuration and Defaults chapter
  • Implement cookie storage adapter
• Make arguments for protectForForgery configurable via set
• Update CHANGELOG

[chrisdpeters]

Added related isOptions and isHead methods in 8a81e85.

Documentation:

• isOptions
• isHead

Work on this has begun!

[chrisdpeters]

Docs for protectFromForgery

[chrisdpeters]

Docs for csrfMetaTags

[chrisdpeters]

Docs for authenticityTokenField

[chrisdpeters]

Start to upgrading instructions. After I get things a little more solidified, I'd like to move the info from the plugin page into the core docs.

[chrisdpeters]

I'm happy to report that I finally have a cookie adapter implemented in v0.1.0 of the plugin. Now I will work to port this to the core, write tests, and finish up the docs.

[chrisdpeters]

(I also want to "battle test" this new cookie adapter in our production apps as well. If there are any problems, we usually learn of them pretty fast.)

[chrisdpeters]

Docs for new settings:
http://docs.cfwheels.org/v2.0/docs/configuration-and-defaults#csrf-protection-settings

[chrisdpeters]

This has now landed in master! 🎉

I don't have time to look into the failing tests. The ones I looked into didn't make any sense.

[neokoenig]

I managed to kick your tests through - passing!

[chrisdpeters]

I'm sure you've explained before, but remind me what I need to do when I run into a situation like that?

[neokoenig]

RDP in, open chrome and click on the "Redeploy" bookmark, then to be sure, click on the CF10 tests bookmark which will run them locally: I usually find it good to run them locally just to check it not throwing any genuine failures: then restart the test from Travis.

[chrisdpeters]

@neokoenig Thanks!