{"action":"closed","issue":{"url":"https://api.github.com/repos/hapijs/crumb/issues/73","repository_url":"https://api.github.com/repos/hapijs/crumb","labels_url":"https://api.github.com/repos/hapijs/crumb/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/crumb/issues/73/comments","events_url":"https://api.github.com/repos/hapijs/crumb/issues/73/events","html_url":"https://github.com/hapijs/crumb/issues/73","id":140582530,"number":73,"title":"Validate/Requiring an incoming crumb even if CORS origin does not match","user":{"login":"briandela","id":1672480,"avatar_url":"https://avatars.githubusercontent.com/u/1672480?v=3","gravatar_id":"","url":"https://api.github.com/users/briandela","html_url":"https://github.com/briandela","followers_url":"https://api.github.com/users/briandela/followers","following_url":"https://api.github.com/users/briandela/following{/other_user}","gists_url":"https://api.github.com/users/briandela/gists{/gist_id}","starred_url":"https://api.github.com/users/briandela/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briandela/subscriptions","organizations_url":"https://api.github.com/users/briandela/orgs","repos_url":"https://api.github.com/users/briandela/repos","events_url":"https://api.github.com/users/briandela/events{/privacy}","received_events_url":"https://api.github.com/users/briandela/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-14T05:52:31Z","updated_at":"2016-06-15T18:49:54Z","closed_at":"2016-06-15T18:49:54Z","body":"I wanted to get your thoughts on validating/requiring an incoming crumb value (cookie/payload), even if the CORS origin does not match.\r\n\r\nI know setting a crumb cookie when the CORS origin does not match is considered token leaking but would it be possible to require the existence of a crumb to be present and that crumb to be valid?\r\n\r\nFor example, here are some scenarios (how it works today):\r\n- with cors disabled\r\n - if I don't have a crumb or it's not valid, the request will 403\r\n- with cors enabled and a matching cors origin\r\n - if I don't have a crumb or it's not valid, the request will 403\r\n- **with cors enabled, and a non-matching origin**\r\n - the presence or lack of crumb doesn't make any difference and the request handler will run normally, as in today's code, `generateCrumb` is not called and it is critical to the validation flow.\r\n\r\nWould it be possible to change the code flow so that in the final scenario, the `with cors enabled, and a non-matching origin`, the code still checks for a valid crumb? I believe it would involve refactoring the code a bit to separate the crumb validation from the `generate` call; it looks like today that generate has two responsibilities:\r\n\r\n1. read the current crumb cookie and if it exists, set the value of it to `request.plugins.crumb` (the existence of `request.plugins.crumb` is later used to determine if a check should even happen on the crumb)\r\n1. read the current crumb cookie, and if it **does not** exist, generate a crumb, and set a cookie for the response using `reply.state`, and set the value to `request.plugins.crumb`\r\n\r\nWhen the CORS origins do not match, `2.` above is the potential for leaking the CSRF cookie as it would set a crumb, but I also think that `1.` could be achieved independently of `2.`, by not having `generate` have multiple responsibilities, and thus still validate CSRF for non-matching CORS origins?\r\n\r\nThoughts on this @stongo? I'll gladly submit a PR if you think it would be an acceptable way forward.\r\n\r\n\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"briandela"}}