Support for iFrames with CSRF? about staticman

[eduardoboucas]

Since all form requests will be cross-origin, wouldn't it be enough to check that the Origin header matches a value defined in the config?

[envygeeks]

For browsers sure, but it's easy to spoof anything with cURL, Ruby or any scripted language (including JavaScript on metal.) and send whatever data you need send. If moderation were enabled it makes it easier to catch these issues but without it, it becomes a problem.

[envygeeks]

I guess what I am saying is, I can send whatever origin pleases me if it's not in a browser and even then I might still be able to with a few patches if I really really wanted to (but that's not worth it.) But sending random spam with cURL is easy with origin.

[eduardoboucas]

I'm with you, that makes sense.

I know the basics of using a token for CSRF protection, but I confess I'll have to think/investigate a bit to come up with an implementation for this specific case.

The token is usually generated and appended to the page server-side, which of course we can't do here. This is why you mentioned an iframe, if I understand correctly. Would you load the form from a non-static source, so that it can generate a token? And wouldn't this source have to be the Staticman API, or not necessarily?

(On a side note, I guess still adding a check for Origin wouldn't hurt?)

[eduardoboucas]

Closing due to inactivity. If you're able to provide any more info and assist with direction, please reopen.