Disable CSRF for some paths

[cbetta]

Part of my app is an API. How do I disable CSRF for this and only this action?

[jeffharrell]

Right now it's all or nothing. This is an interesting requirement though. Let me see what I can do when I'm back from node summit.

-- Jeff

On Dec 4, 2013, at 6:44 AM, "Cristiano Betta" <notifications@github.commailto:notifications@github.com> wrote:

Part of my app is an API. How do I disable CSRF for this and only this action?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/46.

[cbetta]

@jeffharrell yeah. Would also like to see how this exactly is supposed to integrate into clientside JS posts. Or is that taken care of already?

[jeffharrell]

Client-side posts done through JavaScript would just need to pass the _csrf value as a body param when CSRF is enabled. This value comes back in the page model, so it could either be injected into the JavaScript or pulled from the page via JavaScript when the page is rendered.

[lmarkus]

Closing as it doesn't belong in this repo.

[mickeyckm]

Any idea when this feature is going to be release?

[kesava]

Would love to know when this feature is going to be released.

[jeffharrell]

This is now possible using Kraken 1.0's meddleware config and setting the routes property on lusca/csrf.

[ccsevers]

@jeffharrell Can you give a quick example of disabling CSRF for a specific route in the meddleware config?

[jasisk]

I'm no @jeffharrell, however ...

If you check out the options meddleware accepts, you'll find this:

• route (string, optional) - An express route against which the middleware should be registered.

Basically, all that meddleware does there is app.use(yourRoute, yourMiddleware) (with some fancy route resolution to support nested apps and stuff—check out the source if you want to find out more about that).

So, assuming you want csrf only on routes under /protect, you could add a config/config.json with the following:

{
    "middleware": {
        "appsec": {
            "priority": 110,
            "module": {
                "name": "lusca",
                "arguments": [
                    {
                        "csrf": false,
                        "xframe": "SAMEORIGIN",
                        "p3p": false,
                        "csp": false
                    }
                ]
            }
        },
        "appsecprotect": {
            "route": "/protect",
            "enabled": true,
            "priority": 111,
            "module": {
                "name": "lusca",
                "arguments": [
                    {
                        "csrf": true
                    }
                ]
            }
        }
    }
}

A quick explanation:
The appsec section is to turn off the default action by kraken to enable csrf. The appsecprotect section is to turn it back on only for routes that begin with /protect.

You can see this working here. Spin up that server and, hit /anything and it'll return 'unknown'. Hit '/protect' and it'll show you the token.

[ccsevers]

Works perfect, thanks!

[jasisk]

Worth mentioning that what's happening here is, for /protect routes, lusca as registered by appsec kicks in, then lusca as registered by appsecprotect kicks in immediately afterwards. If lusca was destructive, that could cause a problem. In this case, since it's not, it merely adds csrf without disabling the others.

I mention this because the reverse—disabling csrf for only some routes—would not work with this pattern.

[ccsevers]

Ahh, yes it actually isn’t working for the disabling csrf. Any options for that? Disabling on certain routes is what I really want actually.

From: Jean-Charles Sisk <notifications@github.commailto:notifications@github.com>
Reply-To: krakenjs/kraken-js <reply@reply.github.commailto:reply@reply.github.com>
Date: Monday, July 7, 2014 at 6:00 PM
To: krakenjs/kraken-js <kraken-js@noreply.github.commailto:kraken-js@noreply.github.com>
Cc: Christopher Severs <csevers@ebay.commailto:csevers@ebay.com>
Subject: Re: [kraken-js] Disable CSRF for some paths (#46)

Worth mentioning that what's happening here is, for /protect routes, lusca as registered by appsec kicks in, then lusca as registered by appsecprotect kicks in immediately afterwards. If lusca was destructive, that could cause a problem. In this case, since it's not, it merely adds csrf without disabling the others.

I mention this because the reverse—disabling csrf for only some routes—would not work with this pattern.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/46#issuecomment-48260470.

[jasisk]

Can't confirm any of this stuff at the moment (on a tablet) but, off the top of my head ...

First, express can take a regular express as a mountpoint. You could register a regex with a negative lookahead to not match on specific routes. Let's say, for example you want to disable csrf for /api routes. The regex you'd want is /^(?!\/api).+$/. The middleware registered against that route will fire for everything BUT routes that start with /api. As I recall, we don't support regex routes in meddleware since json doesn't support regex but I could be mistaken (give it a shot). Could potentially do some funky stuff since we do some mountpath resolution on your behalf but as long as you don't set express:mountpath, don't register kraken with app.use('/someMountPath', kraken()), and don't mount a sub-application, you shouldn't have anything to worry about.

Next, you could disable lusca in config, then write and config your own middleware that conditionally calls the lusca middleware based on the req path. The path <-> regex resolution in express is provided by the path-to-regexp module; you could use that to ensure that your test for /api works the same way as express and then either call next() if it succeeds (i.e., is a /api route) or lusca(options)(req, res, next); if not.

[sayanee]

Just tried for disabling csrf for only one route, while enabling everything else. Still does not work - any work around yet? Thanks!

For reference, my config.json contains:

...
"appsec": {
  "enabled": true,
  "priority": 110,
  "module": {
    "name": "lusca",
    "arguments": [
    {
      "csrf": true,
      "xframe": "SAMEORIGIN",
      "p3p": false,
      "csp": false
    }
    ]
  }
},

"appsecallocate": {
  "route": "/allocate",
  "priority": 111,
  "module": {
    "name": "lusca",
    "arguments": [
    {
      "csrf": false,
      "xframe": "SAMEORIGIN",
      "p3p": false,
      "csp": false
    }
    ]
  }
},
...

[bthibault]

This should be documented somewhere. The only place I could find out how to turn of CSRF / and appsec in general is this thread.

[jasisk]

@bthibault the README mentions application security and shows lusca's default configuration (see appsec in the included middleware section). That said, perhaps this would be a good candidate for the FAQ?

[bigwisu]

I'm trying to turn on CSRF security on more than 1 route..

        "appsecprotect": {
            "route": "/allocate|/resources",
            "enabled": true,
            "priority": 111,
            "module": {
                "name": "lusca",
                "arguments": [
                    {
                        "csrf": true
                    }
                ]
            }
         }

gives me {_csrf} value on both routes.. is that the proper way of specifying?

[lmarkus]

See #193

[bigwisu]

cool so basically REGEX will do..