zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-06-10 06:24:45 +02:00
Code Issues Projects Releases Packages Wiki Activity

Allow XSRF to be sent as POST parameter in addition to HTML header

Browse source 
HTML headers can only be sent via JS, we need this change to allow
secure POST form submission.

The form itself will have a hidden "input" tag  with the XSRF token in it. This
is how other framework do it as well - see
https://en.wikipedia.org/wiki/Cross-site_request_forgery#Synchronizer_token_pattern

This is in preparation for the OT&E setup page, which will be a simple form
with a "submit" button, so using JS for it is overkill.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=226178070
This commit is contained in:
guyben 2018-12-19 08:35:40 -08:00 • committed by Michael Muller
parent 7c9b2172fd
commit da5a8796b8
3 changed files with 202 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
java/google/registry/security/XsrfTokenManager.java
View file

@ -37,6 +37,9 @@ public final class XsrfTokenManager {
/** HTTP header used for transmitting XSRF tokens. */
public static final String X_CSRF_TOKEN = "X-CSRF-Token";
/** POST parameter used for transmitting XSRF tokens. */
public static final String P_CSRF_TOKEN = "xsrfToken";
/** Maximum age of an acceptable XSRF token. */
private static final Duration XSRF_VALIDITY = Duration.standardDays(1);