bisakhmondal commented on a change in pull request #6201:
URL: https://github.com/apache/apisix/pull/6201#discussion_r792358041
##########
File path: apisix/plugins/csrf.lua
##########
@@ -75,11 +75,12 @@ end
local function gen_csrf_token(conf)
local random = math.random()
- local sign = gen_sign(random, conf.expires, conf.key)
+ local expires_timestamp = ngx_time() + conf.expires
+ local sign = gen_sign(random, expires_timestamp, conf.key)
Review comment:
I'd say sign with the current timestamp. and at line 116 perform a diff
`(ngx_time()-expires)` and test if it is greater than `conf.expires`. In this
way, expiry is localized to apisix as it supports the current need of the user.
Any mistake in setting up conf expiry (maybe a big value) value and the tokens
generated with that value can't be used to exploit the infra because generated
tokens can be revoked by reconfiguring the `expires` field.
Also, how about ignoring the check when conf.expires = 0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
