[app.ini] Enable customise CSRF cookie name for "Invalid csrf token"

[yyxx9988]

There is a case of Invalid csrf token error:

domain: example.com
sub-domain1: normal.example.com => set cookie _csrf and cookie domain is *.example.com
sub-domain2: gogs.example.com => set cookie _csrf and cookie domain is gogs.example.com

If a user just use gogs.example.com, everything is fine;
If another user redirect to gogs.example.com from normal.example.com, he got "Invalid csrf token" because CSRF cookie is mixed.

[unknwon]

Why would you allow user uses different domains to connect your Gogs? I think CSRF did the exactly the right thing.

[yyxx9988]

Thanks.

It is by design -- share cookies between different sub-domains to keep user status(login、logout、post、comments...)

There are more sub-domains like a.example.com b.example.com c.example.com gogs.example.com...

But the _csrf from gogs.example.com is conflict with the _csrf from global shared cookies

[unknwon]

Thanks for the info, but I still don't see your answer to my question?

[yyxx9988]

Sorry about that. But the truth is I didn't allow it. Gogs still uses its own reg system to login/logout.

[unknwon]

Shouldn't you only allow one specific domain for users to login/access Gogs?

[yyxx9988]

a.example.com b.example.com c.example.com use account.example.com/user/login to login/access

gogs.example.com uses gogs.example.com/user/login to login/access

they are separated

[unknwon]

If another user redirect to gogs.example.com from normal.example.com, he got "Invalid csrf token" because CSRF cookie is mixed.

OK, then what does this mean? I'm confused.

[unknwon]

I might see what you mean.

So normal.example.com is also using _csrf cookie name which is same as Gogs?

[yyxx9988]

[yyxx9988]

I might see what you mean.
So normal.exampl.ecom is also using _csrf cookie name which is same as Gogs?

Yes, exactly!

[unknwon]

Patch (054e97d) has pushed to fix this issue, please test on develop branch.

Add new config option '[session] CSRF_COOKIE_NAME'.

[yyxx9988]

Thanks very much!