RFC: CSRF protection for forms and presenters

(in czech)

Low level CSRF protection

• Nette will automatically send token in a cookie __csrf with expiration 0 (until the end of the session)
• all POST forms will always send the hidden field __csrf with this token as value + anti-BREACH-attack masking
• unless cookie __csrf will match the POST element __csrf, RequestFactory throws HTTP error 403
• protection will be enabled by default, it can be switched off in the config (and we will not write how in documentation ;-)

Pros:

• it provides automatic protection for all POST forms without having to call addProtection
• it will not depend on session
• some error messages (Please submit this form again) actually helps to attacker
• token in a cookie (as opposed to element <meta>) will not require to change templates and is resistant to BREACH attack

Cons:

• greater risk to disclosure token, attacker can use XSS on the page where the form is not present

Protected Presenter links

activation:

• protection will be used for actions and signals and will be enabled by annotation on the appropriate method
• possibility to activate protection for the whole presenter or component using annotation on class
• it will be possible to activate the protection for the individual presenter's component, in similar way how persistent components are annotated

The principle:

• protected GET links will be marked by empty HTML attribute data-nette-secure
• these links will be send using JavaScript as POST forms to the same URL with a field __csrf
• default implementation will not use jQuery and will be compatible with IE8+
• token will be check in RequestFactory, (see Low level CSRF protection)
• Presenter will check that the link to the protected target (component, action, singal) is sent by a method other than GET / HEAD, otherwise will respond with 403

AJAX:

• protected links can be sent via AJAX method PUT and DELETE, and then the token will be passed in header X-CSRF-Token
• this means that RequestFactory in addition to the POST element __csrf will check header X-CSRF Token