rancher/norman
1
0
Fork 0
mirror of https://github.com/rancher/norman.git synced 2025-09-01 23:36:58 +00:00
Code Issues Releases Wiki Activity

Attempt to fix CSRF, still untested though

Browse Source
This commit is contained in:
Darren Shepherd
2017-12-29 15:04:12 -07:00
parent 2b7bc0968a
commit f5e2adb427
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/server.go
View File

@@ -166,7 +166,7 @@ func (s *Server) handle(rw http.ResponseWriter, req *http.Request) (*types.APICo
return apiRequest, err return apiRequest, err
} }
if err := CheckCSRF(rw, req); err != nil { if err := CheckCSRF(apiRequest); err != nil {
return apiRequest, err return apiRequest, err
} }

16
api/validate.go
View File

@@ -45,12 +45,12 @@ func ValidateAction(request *types.APIContext) (*types.Action, error) {
return &action, nil return &action, nil
} }
func CheckCSRF(rw http.ResponseWriter, req *http.Request) error { func CheckCSRF(apiContext *types.APIContext) error {
if !parse.IsBrowser(req, false) { if !parse.IsBrowser(apiContext.Request, false) {
return nil return nil
} }
cookie, err := req.Cookie(csrfCookie) cookie, err := apiContext.Request.Cookie(csrfCookie)
if err == http.ErrNoCookie { if err == http.ErrNoCookie {
bytes := make([]byte, 5) bytes := make([]byte, 5)
_, err := rand.Read(bytes) _, err := rand.Read(bytes)
@@ -64,13 +64,13 @@ func CheckCSRF(rw http.ResponseWriter, req *http.Request) error {
} }
} else if err != nil { } else if err != nil {
return httperror.NewAPIError(httperror.InvalidCSRFToken, "Failed to parse cookies") return httperror.NewAPIError(httperror.InvalidCSRFToken, "Failed to parse cookies")
} else if req.Method != http.MethodGet { } else if apiContext.Method != http.MethodGet {
/* /*
* Very important to use request.getMethod() and not httpRequest.getMethod(). The client can override the HTTP method with _method * Very important to use apiContext.Method and not apiContext.Request.Method. The client can override the HTTP method with _method
*/ */
if cookie.Value == req.Header.Get(csrfHeader) { if cookie.Value == apiContext.Request.Header.Get(csrfHeader) {
// Good // Good
} else if cookie.Value == req.URL.Query().Get(csrfCookie) { } else if cookie.Value == apiContext.Request.URL.Query().Get(csrfCookie) {
// Good // Good
} else { } else {
return httperror.NewAPIError(httperror.InvalidCSRFToken, "Invalid CSRF token") return httperror.NewAPIError(httperror.InvalidCSRFToken, "Invalid CSRF token")
@@ -78,6 +78,6 @@ func CheckCSRF(rw http.ResponseWriter, req *http.Request) error {
} }
cookie.Path = "/" cookie.Path = "/"
http.SetCookie(rw, cookie) http.SetCookie(apiContext.Response, cookie)
return nil return nil
} }