IdP CSRF Defence

[Philip Smart]

> On 9 Jul 2019, at 17:31, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> I guess providing whatever validation logic that is checking the token can not
>> be bypassed (currently either an normal Profile Action or a SWF Listener), if
>> something did go wrong and the token was not being set in the viewScope
>> using an on-render tag etc. it would not be present in the view, and hence
>> would fail validation when the form it is posted back.
> 
> Yes, though it's also true that "fails safe" is still "fails" and if there's no good way to get the on-render stuff working properly under some conditions, that just breaks the software.

Ah right yes, I see now. 

> 
> What I observed was that on-render expressions at times failed to access the scopes reliably and variables that definitely were set would go missing. That wasn't a case of them not setting something in the view scope. but it led me to trust the whole engine less.
> 
>> That said, I quite like the idea of having a token being set in the viewScope by a
>> SWF Listener, over the reliance on configuring on-render rules.
> 
> Other than the overhead and understanding exactly how it all works to know when to do what, it's certainly interesting. I need to look at the example.

Yes, it is a limited PoC, but if you think (after looking) there is some merit in it, I will explore and test if further then write it up. 

> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> 

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.