-
Notifications
You must be signed in to change notification settings - Fork 96
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
All pages vulnerable to CSRF #9
Comments
I posted a suggestion of how to fix this here: Burt you should fix this before your Securing Grails Applications talk at Springone 2GX, if it's with my pull request, or some variation there of, or I might just have to go to that talk and heckle you(joking obviously). I'll also post this on the jira page because I don't think you see these comments as often. |
As of May 2016, I confirmed that the latest grails 2.x version is still wide open to this attack on all provided forms. Looks like users should override every s2ui form they intend to use and manually apply the CSRF protection described by jdega33. More details from grails guides below: http://docs.grails.org/2.5.x/guide/security.html#securingAgainstAttacks |
• refactored `SecurityUiTagLib.form` by extracting attribute extraction logic into small, protected methods • modified `SecurityUiTagLib.form` to support `useToken` attribute. This may be used to prevent against CSRF attacks • modified user create form to utilize the `useToken` attribute
Code has been reviewed and manually squashed/merged into master by @sdelamo |
Every form in this UI is vulnerable to cross site request forgery. How can it be fixed? Is the application supposed to be automatically fixing all CSRF even in the transitive closure of plugins, via some filter/HTML modification hook? I'm new to Grails so I don't know how this is normally done (if at all).
This can trivially be fixed by wrapping every controller action in withForm.
becomes
... then change all the GSP forms to attach the token.
<g:form method="post">
becomes
<g:form method="post" useToken="true">
The text was updated successfully, but these errors were encountered: