{"action":"created","issue":{"url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/31","repository_url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler","labels_url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/31/comments","events_url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/31/events","html_url":"https://github.com/viniciuschiele/flask-apscheduler/issues/31","id":191811315,"number":31,"title":"CSRF attack possibility?","user":{"login":"eayin2","id":7290696,"avatar_url":"https://avatars.githubusercontent.com/u/7290696?v=3","gravatar_id":"","url":"https://api.github.com/users/eayin2","html_url":"https://github.com/eayin2","followers_url":"https://api.github.com/users/eayin2/followers","following_url":"https://api.github.com/users/eayin2/following{/other_user}","gists_url":"https://api.github.com/users/eayin2/gists{/gist_id}","starred_url":"https://api.github.com/users/eayin2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eayin2/subscriptions","organizations_url":"https://api.github.com/users/eayin2/orgs","repos_url":"https://api.github.com/users/eayin2/repos","events_url":"https://api.github.com/users/eayin2/events{/privacy}","received_events_url":"https://api.github.com/users/eayin2/received_events","type":"User","site_admin":false},"labels":[{"id":209796482,"url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-26T15:29:22Z","updated_at":"2016-11-29T22:16:34Z","closed_at":null,"body":"Is a REST API around apscheduler not coming with the risk of CSRF attacks, considering that someone could add a job by having you click on a link which sends a HTTP POST request to add a job? https://github.com/viniciuschiele/flask-apscheduler/blob/master/flask_apscheduler/views.py#L35-L46 ?\r\nI'd allow access to flask-apscheduler only from localhost, but it might not be sufficient (see: https://lwn.net/Articles/703485/), if you just click a bad link, which knows about your flask-apscheduler service and adds a job to it. If you don't run a webbrowser on your production server you're fine, because then you don't click on any links, but maybe it should still be considered?\r\n\r\nA workaround could be to add jobs via a configuration file (so you are secured by linux file permissions) and then send a REST API request to reload jobs from the configuration file?\r\n\r\nMaybe also adding authentication to HTTP requests could improve security? "},"comment":{"url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/comments/263717676","html_url":"https://github.com/viniciuschiele/flask-apscheduler/issues/31#issuecomment-263717676","issue_url":"https://api.github.com/repos/viniciuschiele/flask-apscheduler/issues/31","id":263717676,"user":{"login":"eayin2","id":7290696,"avatar_url":"https://avatars.githubusercontent.com/u/7290696?v=3","gravatar_id":"","url":"https://api.github.com/users/eayin2","html_url":"https://github.com/eayin2","followers_url":"https://api.github.com/users/eayin2/followers","following_url":"https://api.github.com/users/eayin2/following{/other_user}","gists_url":"https://api.github.com/users/eayin2/gists{/gist_id}","starred_url":"https://api.github.com/users/eayin2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eayin2/subscriptions","organizations_url":"https://api.github.com/users/eayin2/orgs","repos_url":"https://api.github.com/users/eayin2/repos","events_url":"https://api.github.com/users/eayin2/events{/privacy}","received_events_url":"https://api.github.com/users/eayin2/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T22:16:34Z","updated_at":"2016-11-29T22:16:34Z","body":"Just tested it and it works fine for me, thank you! :)\r\n\r\n"}}
{"actor":{"display_login":"eayin2"}}