IdP CSRF Defence

[Philip Smart]

Hi Scott,

Thanks for the feedback.

On 8 Jul 2019, at 23:20, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

As much as I don't love the downside of having to do it all in "user space" so to speak, because of the ease of omitting it by accident, my experience with views, view scope, and on-XXXX rules in the flows is that they're fairly unreliable and subject to weird quirks. It's one thing to rely on them in ways that essentially break if something goes wrong, since that's safe, but relying on them to implement some kind of protective feature is less appealing to me.

I guess providing whatever validation logic that is checking the token can not be bypassed (currently either an normal Profile Action or a SWF Listener), if something did go wrong and the token was not being set in the viewScope using an on-render tag etc. it would not be present in the view, and hence would fail validation when the form it is posted back.

That said, I quite like the idea of having a token being set in the viewScope by a SWF Listener, over the reliance on configuring on-render rules.


I think to some degree we can automate the token checking by adding it to a new action base class that does the check in the preExecute hook, like the conditional action class does. Also easy to toggle on/off that way.

I did not think of that, so I will take a look this week. I can see a conditional profile configuration interface and base classes, but will need to check for a conditional action class.

Phil


It's less SWF-dependent also that way of course, probably could be implemented to some degree at lower layers.

That's my take anyway. I'm sure there are trade-offs.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net<mailto:dev-unsubscribe at shibboleth.net>

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190709/253059dc/attachment.html>