Menu
I've just started porting my GWT-RPC code to the new RequestFactory mechanism.
In order to prevent cross-site request forgery (CSRF), my GWT-RPC code grabbed the session id that had been stored in a cookie, and included it in the payload of the request. Is that possible with RequestFactory?
I understand that there are four mandatory Locator methods, including findEntity(id_type id); so I'm thinking: oh dear: where do I put my session id?
701
The most effective method of protecting against CSRF is by using anti-CSRF tokens. The developer should add such tokens to all forms that allow users to perform any state-changing operations. When an operation is submitted, the web application should then check for the presence of the correct token.
Login CSRF can be mitigated by creating pre-sessions (sessions before a user is authenticated) and including tokens in login form.
So if you set session cookie with SameSite : Strict, Even in the absence of a dedicated CSRF cookie, links generated to your website from third-party websites will not have session cookies in them. Thus, it is not possible to perform CSRF attacks on them.
To prevent CSRF attacks, use anti-forgery tokens with any authentication protocol where the browser silently sends credentials after the user logs in. This includes cookie-based authentication protocols, such as forms authentication, as well as protocols such as Basic and Digest authentication.
Generally, you'll extend DefaultRequestTransport to add the token to the request (such as a custom header, but you could also add it to the request body) and pass it to the init of your RequestFactory. On the server-side, you'll either use a servlet filter or you'll extend RequestFactoryServlet to process the token before even processing the RequestFactory request. You're free to define your own "protocol" here: e.g. returning a 403 or 401 status (or whatever) and then process it in the RequestTransport to communicate the result to your app.
56
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
