CSRF Handler can "trap" users about vertx-auth HOT 7 CLOSED

Hi @chrispatmore

This is the wrong repository, this issue should have been reported to vertx-web.

Anyway, it seems ok to me if you can't make non-GET requests until you get a new token, that's the purpose of the CSRF token.
If you make a GET request though, it should be sent as a response header, even after a POST request which was never replied.

Perhaps what you want is that the cookie is updated if does not contain the refreshed token?

Would that be fine regarding security @pmlopes ?

from vertx-auth.

Oops sorry, do you want me to move it?

Yea GET requests updating the token would be fine, as it would enable the user to carry on without logging in again

from vertx-auth.

Oops sorry, do you want me to move it?

Yes please

from vertx-auth.

CSRF is a mitigation against replay attacks, hence the issue that a request that never finishes, blocks the whole sequence of future requests. The way I see it is that:

https://github.com/vert-x3/vertx-web/blob/d64ec59431aa8d613aa4fbd869466f59b841c1a9/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CSRFHandlerImpl.java#L130-L132C7

and:

https://github.com/vert-x3/vertx-web/blob/d64ec59431aa8d613aa4fbd869466f59b841c1a9/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CSRFHandlerImpl.java#L250

Should only happen on a successful response:

https://github.com/vert-x3/vertx-web/blob/d64ec59431aa8d613aa4fbd869466f59b841c1a9/vertx-web/src/main/java/io/vertx/ext/web/RoutingContext.java#L314

By wrapping that code only in case of success. This should address the cases:

1. a never-ending response, will not rotate the token, (this example) so the next call will succeed
2. a call that fails for some reason (say internal server error) will preserve the state

Tests need to be run to verify if this works as expected.

from vertx-auth.

Thanks @pmlopes !

So @chrispatmore , if you can provide a test for Vert.x Web that shows 1/ and /2 don't work, please open an issue there.

from vertx-auth.

Sorry to be clear, you would like me to:

move this issue to web, then work on this issue using suggestion from @pmlopes ?

from vertx-auth.

Sorry to be clear, you would like me to:

move this issue to web, then work on this issue using suggestion from @pmlopes ?

yes please

from vertx-auth.