You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Twice now in production, we've run into a problem where people end up with two CSRF cookies, which randomly breaks validation of those cookies. I haven't been able to reproduce this in any lab setting, but I think this may be related to key rotation (e.g. #65), as those were test deployments that had a different CSRF key set.
Would it be possible for the error response emitted from a CSRF validation failure to cause any invalid cookie to be deleted?
The text was updated successfully, but these errors were encountered:
Do you have copies of those cookies?
What is similar or shared about them? (Domain?, Path?)
Are production clients being issued cookies from test deployments?
There’s not quite enough to go on here, and key rotation would just mask
the issue, given that I assume you don’t intend to share keys between
testing and prod?
On Mon, Oct 9, 2017 at 11:39 PM Andreas Fuchs ***@***.***> wrote:
Twice now in production, we've run into a problem where people end up with
two CSRF cookies, which randomly breaks validation of those cookies. I
haven't been able to reproduce this in any lab setting, but I think this
may be related to key rotation (e.g. #65
<#65>), as those were test
deployments that had a different CSRF key set.
Would it be possible for the error response emitted from a CSRF validation
failure to cause any invalid cookie to be deleted?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#73>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/AABIcKRqbtAz-uyV8BsQLoMk07QgzTYSks5sqqCtgaJpZM4PzJU->
.
Twice now in production, we've run into a problem where people end up with two CSRF cookies, which randomly breaks validation of those cookies. I haven't been able to reproduce this in any lab setting, but I think this may be related to key rotation (e.g. #65), as those were test deployments that had a different CSRF key set.
Would it be possible for the error response emitted from a CSRF validation failure to cause any invalid cookie to be deleted?
The text was updated successfully, but these errors were encountered: