Project

General

Profile

Actions
Copy link

action #1634

closed

Add protection for XSS and XSRF and more security checks in general

Added by ancorgs almost 11 years ago. Updated almost 11 years ago.

Status:
Resolved
Priority:
Immediate
Assignee:
lnussel
Category:
-
Target version:
Sprint 03
Start date:
2014-02-20
Due date:
% Done:

100%

Estimated time:
10.00 h

Description

More general information:
http://en.wikipedia.org/wiki/Cross-site_scripting
http://en.wikipedia.org/wiki/Cross-site_request_forgery

More Mojolicious specific information:
http://mojolicio.us/perldoc/Mojolicious/Guides/Rendering#Cross-site_request_forgery
http://mojolicio.us/perldoc/Mojolicious#secrets
http://mojolicio.us/perldoc/Mojolicious/Sessions#secure
https://github.com/koorchik/Mojolicious-Plugin-CSRFProtect
http://search.cpan.org/~shibazaki/Mojolicious-Plugin-CSRFDefender-0.0.8/lib/Mojolicious/Plugin/CSRFDefender.pm

Hide closed

Checklist

  • csrf protection for foms
  • csrf token in post links
  • automatic csrf check for all requests != get
  • csrf token in ajax requests
  • client support for csrf
  • worker support for csrf token
  • secure cookies
  • secrets
Actions
Copy link
 #1

Updated by ancorgs almost 11 years ago

  • Target version set to Sprint 03
Actions
Copy link
 #2

Updated by ancorgs almost 11 years ago

  • Assignee set to lnussel
Actions
Copy link
 #3

Updated by lnussel almost 11 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #4

Updated by lnussel almost 11 years ago

Mojolicious-Plugin-CSRFProtect is a bit strange as it duplicates functionality that mojo already provides. Ie it reimplements the function to generate the token and stores the token as 'csrftoken' instead of using mojos' 'csrf_token'

Actions
Copy link
 #5

Updated by lnussel almost 11 years ago

  • % Done changed from 0 to 30
initial CSRF protection support

- automatically add csrf_token to all forms created with form_for
- new postlink command to create links with data-method post and
  csrf_token

pushed to csrf branch

Actions
Copy link
 #6

Updated by lnussel almost 11 years ago

  • % Done changed from 30 to 40
Actions
Copy link
 #7

Updated by lnussel almost 11 years ago

  • Checklist item changed from to [x] csrf protection for foms, [x] csrf token in post links, [x] automatic csrf check for all requests != get, [x] csrf token in ajax requests, [x] client support for csrf, [ ] worker support for csrf token
Actions
Copy link
 #8

Updated by lnussel almost 11 years ago

  • Checklist item changed from to [x] worker support for csrf token
Actions
Copy link
 #9

Updated by lnussel almost 11 years ago

  • Checklist item changed from [x] csrf protection for foms, [x] csrf token in post links, [x] automatic csrf check for all requests != get, [x] csrf token in ajax requests, [x] client support for csrf, [x] worker support for csrf token to [x] csrf protection for foms, [x] csrf token in post links, [x] automatic csrf check for all requests != get, [x] csrf token in ajax requests, [x] client support for csrf, [x] worker support for csrf token, [ ] secure cookies, [ ] secrets
  • % Done changed from 40 to 70
Actions
Copy link
 #10

Updated by lnussel almost 11 years ago

don't store openid in config file, compute it on startup

Actions
Copy link
 #11

Updated by lnussel almost 11 years ago

  • Checklist item changed from to [x] secrets
Actions
Copy link
 #12

Updated by lnussel almost 11 years ago

  • % Done changed from 70 to 80

secrets are stored in the database now

Actions
Copy link
 #13

Updated by lnussel almost 11 years ago

  • Checklist item changed from to [x] secure cookies
Actions
Copy link
 #14

Updated by lnussel almost 11 years ago

  • Status changed from In Progress to Resolved
  • % Done changed from 80 to 100

added https redirect for login, secure cookies, hsts headers

Actions
Copy link

Also available in: Atom PDF