opendev/gerrit
Code Issues Proposed changes

Send XSRF token as a cookie

Browse Source 
For XSRF protection, the REST API requires a special header
"X-Gerrit-Auth" containing a token known only to the JS running on the
server's domain. Previously, this was set as a JS literal in a
<script> tag directly in the output served at /.

To support a purely static JS application, we can't depend on
injecting JS literals into the body of /. Instead, provide the XSRF
token via a cookie on the response for /. Note that this only affects
how the server communicates the XSRF token to the client; we still
require clients to send the token back in the X-Gerrit-Auth header.
The server must ignore an XSRF token cookie sent by the client, since
the cookie will be sent on all requests, including possibly-forged
cross-site requests. As a minor optimization and to avoid confusion
when looking at request traces, the client code discards the cookie as
soon as it is stored in a JS variable.

Change-Id: Ie24051b48186d6f85bccadfe139e2103b4228cbe
This commit is contained in:
Dave Borowitz
2015-11-02 11:17:21 -05:00
parent b459ab1d76
commit aea5d3e2fd
5 changed files with 40 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
gerrit-gwtui/src/main/java/com/google/gerrit/client/Gerrit.java
View File

@@ -17,6 +17,7 @@ package com.google.gerrit.client;
import static com.google.gerrit.common.data.GlobalCapability.CREATE_GROUP;
import static com.google.gerrit.common.data.GlobalCapability.CREATE_PROJECT;
import static com.google.gerrit.common.data.GlobalCapability.VIEW_PLUGINS;
import static com.google.gerrit.common.data.HostPageData.XSRF_COOKIE_NAME;
import com.google.gerrit.client.account.AccountApi;
import com.google.gerrit.client.account.AccountCapabilities;
@@ -477,8 +478,7 @@ public class Gerrit implements EntryPoint {
if (result.accountDiffPref != null) {
myAccountDiffPref = result.accountDiffPref;
}
if (result.xGerritAuth != null) {
xGerritAuth = result.xGerritAuth;
if (result.accountDiffPref != null) {
// TODO: Support options on the GetDetail REST endpoint so that it can
// also return the preferences. Then we can fetch everything with a
// single request and we don't need the callback group anymore.
@@ -513,6 +513,8 @@ public class Gerrit implements EntryPoint {
editPrefs = null;
onModuleLoad2(result);
}
xGerritAuth = Cookies.getCookie(XSRF_COOKIE_NAME);
Cookies.removeCookie(XSRF_COOKIE_NAME);
}
}));
}

3
gerrit-gwtui/src/main/java/com/google/gerrit/client/rpc/RestApi.java
View File

@@ -21,6 +21,7 @@ import static com.google.gwt.http.client.RequestBuilder.PUT;
import com.google.gerrit.client.Gerrit;
import com.google.gerrit.client.RpcStatus;
import com.google.gerrit.common.data.HostPageData;
import com.google.gwt.core.client.GWT;
import com.google.gwt.core.client.JavaScriptObject;
import com.google.gwt.core.client.Scheduler;
@@ -449,7 +450,7 @@ public class RestApi {
}
req.setHeader("Accept", JSON_TYPE);
if (Gerrit.getXGerritAuth() != null) {
req.setHeader("X-Gerrit-Auth", Gerrit.getXGerritAuth());
req.setHeader(HostPageData.XSRF_HEADER_NAME, Gerrit.getXGerritAuth());
}
return req;
}