{"action":"created","issue":{"url":"https://api.github.com/repos/yesodweb/yesod/issues/1161","repository_url":"https://api.github.com/repos/yesodweb/yesod","labels_url":"https://api.github.com/repos/yesodweb/yesod/issues/1161/labels{/name}","comments_url":"https://api.github.com/repos/yesodweb/yesod/issues/1161/comments","events_url":"https://api.github.com/repos/yesodweb/yesod/issues/1161/events","html_url":"https://github.com/yesodweb/yesod/pull/1161","id":133601774,"number":1161,"title":"Have the yesod-auth login form use a CSRF token","user":{"login":"MaxGabriel","id":1274145,"avatar_url":"https://avatars.githubusercontent.com/u/1274145?v=3","gravatar_id":"","url":"https://api.github.com/users/MaxGabriel","html_url":"https://github.com/MaxGabriel","followers_url":"https://api.github.com/users/MaxGabriel/followers","following_url":"https://api.github.com/users/MaxGabriel/following{/other_user}","gists_url":"https://api.github.com/users/MaxGabriel/gists{/gist_id}","starred_url":"https://api.github.com/users/MaxGabriel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MaxGabriel/subscriptions","organizations_url":"https://api.github.com/users/MaxGabriel/orgs","repos_url":"https://api.github.com/users/MaxGabriel/repos","events_url":"https://api.github.com/users/MaxGabriel/events{/privacy}","received_events_url":"https://api.github.com/users/MaxGabriel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yesodweb/yesod/labels/in%20progress","name":"in progress","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-15T01:35:35Z","updated_at":"2016-02-16T07:19:46Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/yesodweb/yesod/pulls/1161","html_url":"https://github.com/yesodweb/yesod/pull/1161","diff_url":"https://github.com/yesodweb/yesod/pull/1161.diff","patch_url":"https://github.com/yesodweb/yesod/pull/1161.patch"},"body":"Closes #1159\r\n\r\nBased on reading this [StackOverflow Post](http://stackoverflow.com/questions/6412813/do-login-forms-need-tokens-against-csrf-attacks) and skimming [this paper](http://seclab.stanford.edu/websec/csrf/csrf.pdf), using CSRF protection on login forms protects against a vulnerability where an attacker submits their own username/password in the login form. Later, the user uses the real site, but doesn't realize they're logged in as the attacker. This creates vulnerabilities like:\r\n\r\n1. If the site logs the user's activity for them (e.g. recently watched videos on YouTube, previous searches on Google), the attacker can see this information by logging in. This allows the attacker to track/spy on the user.\r\n2. The user adds sensitive information to the account, like credit card information, the attacker can login and potentially steal that information or use it on the site.\r\n\r\nI don't think this vulnerability applies to the `Yesod.Auth.Hardcoded` plugin because the attacker couldn't create an account of their own.\r\n\r\nHowever:\r\n\r\n* If I understand the example in `Yesod.Auth.Hardcoded`, one use case is to share one login form that works for both the Hardcoded plugin as well as normal database-backed username/password login, in which case having a CSRF token makes sense\r\n* I don't see a downside to having the CSRF token there\r\n* It makes the Hardcoded plugin work with the CSRF middleware\r\n\r\nDoes this sound like the right solution?"},"comment":{"url":"https://api.github.com/repos/yesodweb/yesod/issues/comments/184556604","html_url":"https://github.com/yesodweb/yesod/pull/1161#issuecomment-184556604","issue_url":"https://api.github.com/repos/yesodweb/yesod/issues/1161","id":184556604,"user":{"login":"snoyberg","id":49415,"avatar_url":"https://avatars.githubusercontent.com/u/49415?v=3","gravatar_id":"","url":"https://api.github.com/users/snoyberg","html_url":"https://github.com/snoyberg","followers_url":"https://api.github.com/users/snoyberg/followers","following_url":"https://api.github.com/users/snoyberg/following{/other_user}","gists_url":"https://api.github.com/users/snoyberg/gists{/gist_id}","starred_url":"https://api.github.com/users/snoyberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snoyberg/subscriptions","organizations_url":"https://api.github.com/users/snoyberg/orgs","repos_url":"https://api.github.com/users/snoyberg/repos","events_url":"https://api.github.com/users/snoyberg/events{/privacy}","received_events_url":"https://api.github.com/users/snoyberg/received_events","type":"User","site_admin":false},"created_at":"2016-02-16T07:19:46Z","updated_at":"2016-02-16T07:19:46Z","body":"@gregwebs You've touched the CSRF code more recently than I have, any thoughts?"}}