CSRF vulnerability

[sercanvirlan]

I think there is no csrf check for ajax. I have removed the token value from frontside, the server accepted my request.

This is very important thing. Am i right?

[daftspunk]

The CSRF token is passed as a courtesy, it cannot easily be generated via JavaScript and hence is not a requirement of an AJAX postback.

You can verify the authenticity of a CSRF token in component/page code using

if (Session::token() != Input::get('_token')) { /* Invalid token */ }

[that0n3guy]

It can't be generated, but it is commonly used w/ ajax: http://words.weareloring.com/development/laravel/laravel-4-csrf-tokens-when-using-jquerys-ajax/

Thats one of the ways I've seen do it.

[daftspunk]

~~More on this can be found here: ~~
https://github.com/octobercms/library/issues/105

CSRF was added to the backend here:
d9dfa21

[oliverpool]

More on this can be found here:
https://github.com/octobercms/library/issues/105

@daftspunk : the issues are now closed on https://github.com/octobercms/library, which means that the link you provided returns an error 404 (maybe only for non-contributors)

Could you maybe copy/paste the relevant informations from this issue ?

[daftspunk]

Comment updated