[
https://issues.apache.org/jira/browse/OFBIZ-11306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17010411#comment-17010411 ]
Jacques Le Roux commented on OFBIZ-11306:
-----------------------------------------
Hi James,
OK, I see no reasons to use CSRFGuard to only generate the token indeed. CSRFGuard 3 seems to do much more. But I had already a bad experience trying to use CSRFGuard (not 3) in OFBiz so I won't push about that.
About all (133!) the
{{jqXHR.setRequestHeader("X-CSRF-Token", $("meta[name='csrf-token']").attr("content"));}}
I suggest to use a global way. We have the choice between
# Intercepting send or open:
https://stackoverflow.com/questions/24196140/adding-x-csrf-token-header-globally-to-all-instances-of-xmlhttprequest# Using header in ajaxSetup:
https://stackoverflow.com/questions/28417781/jquery-add-csrf-token-to-all-post-requests-data# Using ajaxPrefilter
https://blog.alexmaccaw.com/jswebapps-csrfIt seems to me that putting headers in ajaxSetup in util.js is the most convenient one, but I have no strong opinion about it
As noted at[1] all these mehtods have an "inconvenient": they apply also to non OFBiz jQuery Ajax request (those in jQuery itself for instance). I don't think it's a big deal, is that not what we want? Or was it the reason you did so in all Ajax requests?
[1]
https://stackoverflow.com/questions/28417781/jquery-add-csrf-token-to-all-post-requests-data#answer-41346523> POC for CSRF Token
> ------------------
>
> Key: OFBIZ-11306
> URL:
https://issues.apache.org/jira/browse/OFBIZ-11306> Project: OFBiz
> Issue Type: Improvement
> Components: ALL APPLICATIONS
> Affects Versions: Upcoming Branch
> Reporter: James Yong
> Assignee: Jacques Le Roux
> Priority: Minor
> Labels: CSRF
> Fix For: Upcoming Branch
>
> Attachments: OFBIZ-11306-v2.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306_Plugins.patch, OFBIZ-11306_Plugins.patch, OFBIZ-11306_Plugins.patch
>
>
> CRSF tokens are generated using CSRF Guard library and used in:
> 1) In widget form where a hidden token field is auto-generated.
> 2) In FTL form where a <@csrfTokenField> macro is used to generate the csrf token field.
> 3) In Ajax call where a <@csrfTokenAjax> macro is used to assign csrf token to X-CSRF-Token in request header.
> CSRF tokens are stored in the user sessions, and verified during POST request.
> A new attribute i.e. csrf-token is added to the security tag to exempt CSRF token check.
> Certain request path, like LookupPartyName, can be exempt from CSRF token check during Ajax POST call.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
Locked
