[ 
https://issues.apache.org/jira/browse/OFBIZ-11306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16990922#comment-16990922
 ] 

James Yong commented on OFBIZ-11306:
------------------------------------

Hi Jacques,

I have updated my version to the latest 
but unable to apply the new patch to the build.gradle file. 

Hi Samuel,

For Q1:
The CSRFGuard to generate the token is referred by OWASP.
The settings used are taken from this page
https://www.owasp.org/index.php?title=CSRF_Guard&redirect=no

For Q2:
I think accessing map is faster than a list. 
You are right about the every growing token map.
Will do the following:
1) add an option to allow a shared CSRF token for the forms.
2) Put a size limit, e.g. 50, to the token map. When this size limit is 
reached, the eldest entry will be deleted each time a new entry is added.


 

> POC for CSRF Token
> ------------------
>
>                 Key: OFBIZ-11306
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-11306
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: ALL APPLICATIONS
>    Affects Versions: Upcoming Branch
>            Reporter: James Yong
>            Assignee: Jacques Le Roux
>            Priority: Minor
>              Labels: CSRF
>             Fix For: Upcoming Branch
>
>         Attachments: OFBIZ-11306.patch, OFBIZ-11306.patch
>
>
> CRSF tokens are generated using CSRF Guard library and used in:
> 1) In widget form where a hidden token field is auto-generated.
> 2) In FTL form where a <@csrfTokenField> macro is used to generate the csrf 
> token field. 
> 3) In Ajax call where a <@csrfTokenAjax> macro is used to assign csrf token 
> to X-CSRF-Token in request header. 
> CSRF tokens are stored in the user sessions, and verified during POST request.
> A new attribute i.e. csrf-token is added to the security tag to exempt CSRF 
> token check.
> Certain request path, like LookupPartyName, can be exempt from CSRF token 
> check during Ajax POST call. 



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Reply via email to