http: Add config option to disable CSRF protection (Fixes: #1713) #1714
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kingosticks
added
C-enhancement
jodal
approved these changes
Oct 11, 2018
docs/ext/http.rst
Outdated
| .. confval:: http/disable_csrf_protection | ||
|
|
||
| Disable the HTTP server's protection against Cross-Site Request Forgery | ||
| (CSRF) from both JSON-RPC and Websocket requests. |
docs/ext/http.rst
Outdated
| This will remove the requirement to set a ``Content-Type: application/json`` | ||
| header for JSON-RPC POST requests. It will also disable all same-origin | ||
| checks, effectively ignoring the ``allowed_origins`` config since requests | ||
| from any origin will be allowed. Lastly, all ``'Access-Control-Allow-*`` |
There was a problem hiding this comment.
Extra quote mark before the header name.
kingosticks
force-pushed
the
feature/disable-http-csrf-config
branch
from
fd9cba9
to
02f9244
Compare
|
Also added the issue/pr numbers to the changelog. |
kingosticks
force-pushed
the
feature/disable-http-csrf-config
branch
from
02f9244
to
2828a43
Compare
|
Looks good to me. Only suggestion I'd have is, if it's going to be called and double negation always gives me headaches. But that's nit-picking, really. |
tkem
approved these changes
Oct 12, 2018
jodal
requested changes
Oct 12, 2018
mopidy/http/handlers.py
Outdated
| @@ -20,17 +20,23 @@ | |||
|
|
|||
| def make_mopidy_app_factory(apps, statics): | |||
| def mopidy_app_factory(config, core): | |||
| disable_csrf_protection = not config['http']['csrf_protection'] | |||
There was a problem hiding this comment.
You need to rename this variable and flip the logic here.
There was a problem hiding this comment.
Ok, I actually misread this and didn't notice the "not". I guess that proves my point. :-)
docs/ext/http.rst
Outdated
|
|
||
| Disabling this will remove the requirement to set a ``Content-Type: application/json`` | ||
| header for JSON-RPC POST requests. It will also disable all same-origin | ||
| checks, effectively ignoring the ``allowed_origins`` config since requests |
There was a problem hiding this comment.
s/``allowed_origins``/:confval:`http/allowed_origins`/
|
Ha well your belief in my tests says more! I'm away over the weekend but I can change it next week. |
kingosticks
force-pushed
the
feature/disable-http-csrf-config
branch
from
2828a43
to
b7f4fd0
Compare
Allows users to disable CSRF protection and revert to the HTTP server's
previous (less secure) behaviour. Users are advised to leave this config
value enabled if possible. However, if disabled this will:
* Remove the requirement to set a ``Content-Type: application/json``
header for JSON-RPC POST requests.
* Disable all same-origin checks, effectively ignoring the ``allowed_origins``
config since requests from any origin will be allowed.
* Suppress all ``Access-Control-Allow-*`` response headers.
kingosticks
force-pushed
the
feature/disable-http-csrf-config
branch
from
b7f4fd0
to
10fafc0
Compare
|
That should be all consistent now. |
jodal
approved these changes
Oct 15, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This will remove the requirement to set a
Content-Type: application/jsonheader for JSON-RPC POST requests. It will also disable all same-origin
checks, effectively ignoring the
allowed_originsconfig since requestsfrom any origin will be allowed. Lastly, all
'Access-Control-Allow-*response headers will be suppressed.
I am not sold on the config name but I wanted to make it really clear that setting it is less secure. Alternate name suggestions welcome.
Also, I am not 100% sure if we should be disabling all the protections (as is currently implemented here) or if we should just remove the requirement to set a
Content-Typeheader...