Bug #55703

CSRF Protection with X-Flow-CsrfToken Header doesn't work

Added by Stefan Aebischer over 7 years ago. Updated over 7 years ago.

Status:
Resolved
Priority:
Should have
Assignee:
-
Category:
-
Start date:
2014-02-05
Due date:
% Done:

100%

Estimated time:
PHP Version:
5.4
Has patch:
No
Complexity:
no-brainer

Description

If the CSRF Token is submited as X-Flow-CsrfToken Request Header, the token validation fails, even if the correct token is submited.
The CsrfProtection RequestPattern tries to get the X-Flow-CsrfToken Header in order to validate the request (around line 108 in TYPO3\Flow\Security\RequestPattern\CsrfProtection).

The header is transformed from X-Flow-CsrfToken to HTTP-X-FLOW-CSRFTOKEN through PHP and afterwards in TYPO3\Flow\Http around line 72 to X-Flow-Csrftoken (lower t in Token).

A solution could be to name the header X-Flow-Csrf-Token.

Affected Version is 2.1.0 (not available to choose)


Files

csrfToken.diff (861 Bytes) csrfToken.diff Stefan Aebischer, 2014-02-05 17:44
#1

Updated by Gerrit Code Review over 7 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30234

#2

Updated by Gerrit Code Review over 7 years ago

Patch set 2 for branch master of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30234

#3

Updated by Gerrit Code Review over 7 years ago

Patch set 1 for branch 2.2 of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30262

#4

Updated by Gerrit Code Review over 7 years ago

Patch set 1 for branch 2.1 of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30263

#5

Updated by Gerrit Code Review over 7 years ago

Patch set 3 for branch master of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30234

#6

Updated by Gerrit Code Review over 7 years ago

Patch set 1 for branch 2.2 of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30264

#7

Updated by Gerrit Code Review over 7 years ago

Patch set 1 for branch 2.1 of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30265

#8

Updated by Gerrit Code Review over 7 years ago

Patch set 2 for branch 2.1 of project Packages/TYPO3.Flow has been pushed to the review server.
It is available at https://review.typo3.org/30265

#9

Updated by Martin Helmich over 7 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

Also available in: Atom PDF