CSRF rejections should be logged by default

[bitemyapp]

I've made a custom CSRF middleware privately that logs that a request was rejected. This is needed because the user will never see any of the log output from their handler and the body seems to be empty when this happens.

I could respin this with a parameterization that takes a logLevel and then update the scaffolds if people are open to this.

[MaxGabriel]

Logging CSRF errors sounds useful. I like that idea. I thought that a 403 was logged when CSRF failure happened though. Maybe I'm misremembering.

Currently the scaffolding doesn't have CSRF middleware anymore (most of Yesod-auth was breaking under it). But I think all that's been fixed, so it may be ready to be added back.

[MaxGabriel]

So you will get a 403 logged, but it won't obviously be a CSRF error:

POST /comments
  Request Body: {"message":"test"}
  Accept: */*
  Status: 403 Forbidden 0.000439s

Do you think more is needed?

I could respin this with a parameterization that takes a logLevel and then update the scaffolds if people are open to this.

Another potential option—not sure if this is too much—but we could allow running an arbitrary handler action on CSRF failure. This gives a little more flexibility (you could raise an exception, or log to graphite, or log to a file, or clear the session but allow the request, or whatever), but is slightly more complex.

[bitemyapp]

Do you think more is needed?

I've lost hours to this recently and I've been using Yesod for 3+ years, so yeah, I think more is needed.

Another potential option—not sure if this is too much—but we could allow running an arbitrary handler action on CSRF failure.

I'm fine with that, but I'd still like the default to log something as logWarn whatever we do with the extensibility of the code.

[MaxGabriel]

@bitemyapp Ok, I think having written the CSRF middleware stuff and intentionally triggered it so many times that I didn't have a good perspective on what it's like for other developers. Thanks for reporting this. Thoughts on #1200?