{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/4002","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4002/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4002/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4002/events","html_url":"https://github.com/spring-projects/spring-security/pull/4002","id":168978575,"number":4002,"title":"Fix Issue 4001: CSRF tokens are vulnerable to a BREACH attack","user":{"login":"johnraycp","id":20798365,"avatar_url":"https://avatars.githubusercontent.com/u/20798365?v=3","gravatar_id":"","url":"https://api.github.com/users/johnraycp","html_url":"https://github.com/johnraycp","followers_url":"https://api.github.com/users/johnraycp/followers","following_url":"https://api.github.com/users/johnraycp/following{/other_user}","gists_url":"https://api.github.com/users/johnraycp/gists{/gist_id}","starred_url":"https://api.github.com/users/johnraycp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnraycp/subscriptions","organizations_url":"https://api.github.com/users/johnraycp/orgs","repos_url":"https://api.github.com/users/johnraycp/repos","events_url":"https://api.github.com/users/johnraycp/events{/privacy}","received_events_url":"https://api.github.com/users/johnraycp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-08-02T20:19:21Z","updated_at":"2016-08-08T21:38:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/spring-projects/spring-security/pulls/4002","html_url":"https://github.com/spring-projects/spring-security/pull/4002","diff_url":"https://github.com/spring-projects/spring-security/pull/4002.diff","patch_url":"https://github.com/spring-projects/spring-security/pull/4002.patch"},"body":"This is to fix issue 4001. The changes are:\r\n- add an isValid() method to the CsrfToken interface to compare a String value from a HTTP request to a CsrfToken object.\r\n- Modify DefaultCsrfToken\r\n    - The constructor now generate it's own CSRF token instead of having it passed in\r\n    - getToken() always return a different value. \r\n    - Implement the isValid() method to check if a value is valid.\r\n- The remainder of the changes were needed because of the DefaultCsrfToken constructor change and that isValid() must be called instead of the caller doing it's own string compare.\r\n"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/238385862","html_url":"https://github.com/spring-projects/spring-security/pull/4002#issuecomment-238385862","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4002","id":238385862,"user":{"login":"johnraycp","id":20798365,"avatar_url":"https://avatars.githubusercontent.com/u/20798365?v=3","gravatar_id":"","url":"https://api.github.com/users/johnraycp","html_url":"https://github.com/johnraycp","followers_url":"https://api.github.com/users/johnraycp/followers","following_url":"https://api.github.com/users/johnraycp/following{/other_user}","gists_url":"https://api.github.com/users/johnraycp/gists{/gist_id}","starred_url":"https://api.github.com/users/johnraycp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnraycp/subscriptions","organizations_url":"https://api.github.com/users/johnraycp/orgs","repos_url":"https://api.github.com/users/johnraycp/repos","events_url":"https://api.github.com/users/johnraycp/events{/privacy}","received_events_url":"https://api.github.com/users/johnraycp/received_events","type":"User","site_admin":false},"created_at":"2016-08-08T21:38:07Z","updated_at":"2016-08-08T21:38:07Z","body":"Over at the website http://breachattack.com/ in the mitigation section there are a few different solutions. You're talking about #3 \"Randomizing secrets per request\". My code is for #4 \"Masking secrets (effectively randomizing by XORing with a random secret per request)\".\r\n\r\n#3 is slightly more secure but would require spring to keep a list of CSRF tokens.\r\n#4 only stores one token in the session.\r\n\r\nThe main thing you want to do to prevent a BREACH attack is to send a random CSRF string with each request. It's fine if you can use the CSRF token from one request in a different one. Also #4 seems to be the solution that other frameworks are implementing. I assume they don't do #3 because there is no easy way to determine which CSRF tokens might still be used and which can't because the user can open pages in different tabs. So you end up have to keep a potentially large list of tokens in memory.\r\n"}}
{"actor":{"display_login":"johnraycp"}}