CRSF Warning Needs Conditions
Bug #530271 reported by
Julien Funk
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Canonical SSO provider |
Fix Released
|
Medium
|
David Owen |
Bug Description
The security fix that prevents CRSF forgeries should be tweaked. At the moment it is giving forgery messages when no forgery is attempted.
Steps to Reproduce:
1. On staging log out of SSO, then log into a consumer.
2. Ensure that you have a window of SSO open on the entry page
3. After logging into the consumer via SSO, stay logged in and go back to the login page of SSO
4. On the other window attempt to log in thorugh the original entry page
You will get a forgery message
Related branches
lp://staging/~canonical-isd-hackers/canonical-identity-provider/bug_530271_csrf
- Łukasz Czyżykowski (community): Approve
-
Diff: 233 lines (+122/-19)4 files modifiedidentityprovider/middleware/csrf.py (+6/-2)
identityprovider/templates/403-csrf.html (+21/-0)
identityprovider/tests/test_middleware.py (+92/-16)
identityprovider/views/ui.py (+3/-1)
Changed in canonical-identity-provider: | |
milestone: | none → 2.6.0 |
Changed in canonical-identity-provider: | |
assignee: | Stuart Metcalfe (stuartmetcalfe) → nobody |
Changed in canonical-identity-provider: | |
assignee: | nobody → David Owen (dsowen) |
Changed in canonical-identity-provider: | |
status: | Confirmed → In Progress |
Changed in canonical-identity-provider: | |
status: | In Progress → Confirmed |
Changed in canonical-identity-provider: | |
status: | Confirmed → In Progress |
Changed in canonical-identity-provider: | |
status: | In Progress → Fix Committed |
Changed in canonical-isd-qa: | |
assignee: | nobody → Dave Morley (davmor2) |
Changed in canonical-identity-provider: | |
status: | Fix Committed → Fix Released |
To post a comment you must log in.
We should look into the possibility of stacking forms in the session rather than only having one. The forms should definitely each have an independent (and relatively short) expiry time. This could be an issue for any user who is logged in to multiple sso-dependent sites after a browser crash/recovery if their sessions have expired in more than one of the sites.