Good practice for CSRF-safety after login?

Nicolas_K
Member | 25
+
0
-

Hello!

Where can I find info regarding CSRF?

Last edited by Nicolas_K (2023-07-15 00:54)

Nicolas_K
Member | 25
+
0
-

Aah.. yeah! Thank you! .]

Nicolas_K
Member | 25
+
0
-

Ok – I changed my original question related to the answer.. :)

Here is a more serious question:
Starting from one presenter, I have a User with Identity.
How can I pass this to another presenter?
(So that I can ask if user->isLoggedIn() there..)

Marek Bartoš
Nette Blogger | 1130
+
0
-

User login is by default stored in session. So just log in, it will be available in other presenters

Nicolas_K
Member | 25
+
0
-

Thank you, Marek,
but now I have configured cookie storage…
Then what to do ?-

Marek Bartoš
Nette Blogger | 1130
+
0
-

Should be the same 🤷‍♂️

Nicolas_K
Member | 25
+
0
-

It works.
I had to amend the configuration:

security:
	authentication:
		expiration: 20 minutes
		storage: cookie
		cookieName: mycookiename
		cookieSamesite: Strict
		cookieDomain: 'mydomain.local'

cookieSamesite: Lax didn't change anything.
But cookieDomain: 'mydomain.local' did.
(Behavior like stated here?: https://doc.nette.org/…onfiguration#… )

And: why is cookieHttpOnly in Response deprecated?
(https://api.nette.org/…esponse.html )
Is this feature replaced by another, that prevents handling with JS?

Last edited by Nicolas_K (2023-07-15 21:53)

Marek Bartoš
Nette Blogger | 1130
+
+1
-

why is cookieHttpOnly in Response deprecated

All cookies are http-only by default and you can disable it for individual cookies.

Nicolas_K
Member | 25
+
0
-

Thank you very much, Marek!
Again, some fog is blowing away.. !-))