{"action":"created","issue":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2173","repository_url":"https://api.github.com/repos/symphonycms/symphony-2","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2173/labels{/name}","comments_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2173/comments","events_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2173/events","html_url":"https://github.com/symphonycms/symphony-2/issues/2173","id":40979445,"number":2173,"title":"XSRF token is not generated in the frontend","user":{"login":"michael-e","id":40072,"avatar_url":"https://avatars.githubusercontent.com/u/40072?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-e","html_url":"https://github.com/michael-e","followers_url":"https://api.github.com/users/michael-e/followers","following_url":"https://api.github.com/users/michael-e/following{/other_user}","gists_url":"https://api.github.com/users/michael-e/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-e/subscriptions","organizations_url":"https://api.github.com/users/michael-e/orgs","repos_url":"https://api.github.com/users/michael-e/repos","events_url":"https://api.github.com/users/michael-e/events{/privacy}","received_events_url":"https://api.github.com/users/michael-e/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symphonycms/symphony-2/labels/3%20-%20Major","name":"3 - Major","color":"FF6600"}],"state":"open","locked":false,"assignee":{"login":"nitriques","id":771169,"avatar_url":"https://avatars.githubusercontent.com/u/771169?v=3","gravatar_id":"","url":"https://api.github.com/users/nitriques","html_url":"https://github.com/nitriques","followers_url":"https://api.github.com/users/nitriques/followers","following_url":"https://api.github.com/users/nitriques/following{/other_user}","gists_url":"https://api.github.com/users/nitriques/gists{/gist_id}","starred_url":"https://api.github.com/users/nitriques/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nitriques/subscriptions","organizations_url":"https://api.github.com/users/nitriques/orgs","repos_url":"https://api.github.com/users/nitriques/repos","events_url":"https://api.github.com/users/nitriques/events{/privacy}","received_events_url":"https://api.github.com/users/nitriques/received_events","type":"User","site_admin":false},"assignees":[{"login":"nitriques","id":771169,"avatar_url":"https://avatars.githubusercontent.com/u/771169?v=3","gravatar_id":"","url":"https://api.github.com/users/nitriques","html_url":"https://github.com/nitriques","followers_url":"https://api.github.com/users/nitriques/followers","following_url":"https://api.github.com/users/nitriques/following{/other_user}","gists_url":"https://api.github.com/users/nitriques/gists{/gist_id}","starred_url":"https://api.github.com/users/nitriques/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nitriques/subscriptions","organizations_url":"https://api.github.com/users/nitriques/orgs","repos_url":"https://api.github.com/users/nitriques/repos","events_url":"https://api.github.com/users/nitriques/events{/privacy}","received_events_url":"https://api.github.com/users/nitriques/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/symphonycms/symphony-2/milestones/30","html_url":"https://github.com/symphonycms/symphony-2/milestones/2.8.0","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/milestones/30/labels","id":1941405,"number":30,"title":"2.8.0","description":"","creator":{"login":"nitriques","id":771169,"avatar_url":"https://avatars.githubusercontent.com/u/771169?v=3","gravatar_id":"","url":"https://api.github.com/users/nitriques","html_url":"https://github.com/nitriques","followers_url":"https://api.github.com/users/nitriques/followers","following_url":"https://api.github.com/users/nitriques/following{/other_user}","gists_url":"https://api.github.com/users/nitriques/gists{/gist_id}","starred_url":"https://api.github.com/users/nitriques/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nitriques/subscriptions","organizations_url":"https://api.github.com/users/nitriques/orgs","repos_url":"https://api.github.com/users/nitriques/repos","events_url":"https://api.github.com/users/nitriques/events{/privacy}","received_events_url":"https://api.github.com/users/nitriques/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":0,"state":"open","created_at":"2016-08-15T00:24:53Z","updated_at":"2016-08-15T00:46:28Z","due_on":null,"closed_at":null},"comments":27,"created_at":"2014-08-23T16:44:26Z","updated_at":"2016-08-15T10:07:02Z","closed_at":null,"body":"In the frontend (i.e. without a visitor being logged in to Symphony), XSRF tokens are not generated. The backend uses `$this->Page->Form->prependChild(XSRF::formToken());` on every form, which will in turn call `self::getToken()`—so a token gets generated. But in the frontend, this doesn't happen (since we don't want to automatically inject any token markup). My first idea to solve this is to add:\r\n\r\n    XSRF::getToken();\r\n\r\nin line 422 of `class.frontendpage.php` (immediately before adding the cookie values).\r\n\r\nHowever, I am not sure if this is the correct approach."},"comment":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/comments/239769542","html_url":"https://github.com/symphonycms/symphony-2/issues/2173#issuecomment-239769542","issue_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2173","id":239769542,"user":{"login":"michael-e","id":40072,"avatar_url":"https://avatars.githubusercontent.com/u/40072?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-e","html_url":"https://github.com/michael-e","followers_url":"https://api.github.com/users/michael-e/followers","following_url":"https://api.github.com/users/michael-e/following{/other_user}","gists_url":"https://api.github.com/users/michael-e/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-e/subscriptions","organizations_url":"https://api.github.com/users/michael-e/orgs","repos_url":"https://api.github.com/users/michael-e/repos","events_url":"https://api.github.com/users/michael-e/events{/privacy}","received_events_url":"https://api.github.com/users/michael-e/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T10:07:02Z","updated_at":"2016-08-15T10:07:02Z","body":"I am not sure.\r\n\r\n1. We already have an event to validate the token. It's provided by the Cross-Site Scripting (XSS) Filter extension. So this event could be moved to a new extension. But it must be noted that XSRF protection may be circumvented by XSS attacks. [Wikipedia](https://en.wikipedia.org/wiki/Cross-site_request_forgery) says:\r\n\r\n    > Cross-site scripting (XSS) vulnerabilities (even in other applications running on the same domain) allow attackers to bypass most CSRF preventions.\r\n\r\n    That might give a reason to keep the event in the XSS extension (because this enforces XSS protection if you want XSRF functionality). Choosing a better name for the extension may be a good idea, however.\r\n\r\n2. The new extension (or the existing one, see above) would also provide a token on **every page** (unless this can be triggered by a separate event, making things more complicated for the developer). It should do that without duplicating any security-related code from the core. If the token is on every page, the effect will be the same as with my proposal: There's always a session. Providing the token on certain pages only has no big advantage: Once you have seen a token, your session will last (because a non-empty session will never be dropped by Symphony).\r\n\r\n    Using XSRF tokens on the frontend will always mean that you need sessions/cookies. And this makes simple frontend caching (using Varnish or nginx) impossible. Well, that's the price! (If you want to protect a web application, your app will need logged-in users with sessions/cookies anyway.)\r\n\r\nBTW, I have already implemented XSRF protection in one of my web apps using the XSS Filter extension and the simple Symphony hack proposed above. It works.\r\n\r\n> I even question the whole presence of the cookie-* values in the parameters.\r\n\r\nI don't really understand what you mean here. An XSRF token is simply tied to a session, and it must be, AFAIK."}}
{"actor":{"display_login":"michael-e"}}