I love modules that help me do the right thing in my code, especially when I often
forget to do something. Today's module is very straight-forward —
[verify-csrf-interceptor](https://www.forgebox.io/view/verify-csrf-interceptor) —
an interceptor that will automatically check for CSRF tokens for all non-GET requests
to help protect against [cross-site request forgery.](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF))
verify-csrf-interceptor
To mitigate CSRF attacks, CFML has two built-in methods to handle CSRF tokens
— csrfGenerateToken and
csrfVerifyToken. You should include a
generate token in any form submission in your application and verify it in your
handlers or controllers.
It's very easy to miss this, though, because you have to wire up both the token generation in the form and the token verification in the handler. This interceptor takes care of the token verification.
It's such a short function, let's take a look at it in its entirety here:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
/*** Verifies the CSRF token on all non-GET requests*/component extends="coldbox.system.Interceptor"{ public void function configure() {} public void function preEvent( event, interceptData ) { if ( event.getHTTPMethod() == "GET" ) { return; } if ( actionMarkedToSkip( event, interceptData ) ) { return; } if ( ! event.valueExists( "_token" ) ) { throw( type = "TokenMismatchException", message = "The CSRF token was not included." ); } if ( ! CSRFVerifyToken( event.getValue( "_token" ) ) ) { throw( type = "TokenMismatchException", message = "The CSRF token is invalid." ); } } private boolean function actionMarkedToSkip( required event, required struct interceptData ) { var handler = getController() .getHandlerService() .getRegisteredHandler( interceptData.processedEvent ); var md = getComponentMetadata( "#handler.getInvocationPath()#.#handler.getHandler()#" ); var funcs = arrayFilter( md.functions, function( func ) { return func.name == handler.getMethod(); } ); if ( NOT arrayIsEmpty( funcs ) ) { if ( structKeyExists( funcs[1], "skipCSRFCheck" ) ) { return true; } } return false; } } |
Wrap Up
Protect yourself from simple omissions like forgetting to generate and verify
CSRF tokens — install verify-csrf-interceptor
today and it will start verifying for you with no further configuration.
That's the power of ColdBox modules!
Add Your Comment