Hi Giles,
Well, IMHO, only direct actions can be vulnerable to Cross-Site Attack.
To prevent this you can avoid to handle Session ID in Cookies and force
urls to contains the Session ID in each request (BTW, this is the default
WO behaviour). Second, you can check in Direct Actions that the
http-referer domain is the same of your app
(request().headerForKey("referer")).
For me, the best way to avoid Cross-Site Attack would be using session-less
Direct Actions, with POST auth credential in each request. Under HTTPS of
course...
Hope this help!
Bye
--
Daniele Corti
--
I DON'T DoubleClick
2012/1/26 Giles Palmer <[email protected]>
> Hi All
>
> We have an application that lives behind a login and all requests are
> session based component requests. We have been asked by a user about our
> vulnerability to Cross-site request forgery.
>
> http://en.wikipedia.org/wiki/Cross-site_request_forgery
> and
> https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
>
> What do you guys do to protect against this? Are component urls and an
> authenticated session enough to prevent this?
>
> Advice much appreciated.
>
>
> Regards
>
>
> Giles
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Webobjects-dev mailing list ([email protected])
> Help/Unsubscribe/Update your Subscription:
> https://lists.apple.com/mailman/options/webobjects-dev/ildenae%40gmail.com
>
> This email sent to [email protected]
>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list ([email protected])
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/webobjects-dev/archive%40mail-archive.com
This email sent to [email protected]
