Add authentication token to prevent csrf attacks

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 5.1.2, 5.2.3
• Fix Version/s: None
• Component/s: Security
• Labels: None
• Branch Version/s:
  5.1.x, 5.2.x
• Backported to Branch:
  Committed
• Similar Issues: Show 4 results ; ;

  LPS-21688	CSRF security issue
  LPS-32428	Invalid authentication token in Calendar
  LPS-18184	Rest Proxy allows remote attacks
  LPS-16279	Avoiding authentication token errors on links checked by robots

See http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 for more info

[Amos Fong]

Committed fix

[Samuel Kong]

Nice! I've been waiting for this. Thanks Amos.

[Jorge Ferrer]

This is nice Amos,

Nevertheless, my personal opinion is that it's still much better to rely on using POST whenever possible since it's a more straighforward solution and doesn't rely on the session.

[Amos Fong]

Hey Jorge,

Only checking POST wasn't sufficient because you can create a CSRF attack that can POST too.

[Jorge Ferrer]

Oops, you're right! I just read again the wiki from owasp and its linked articles and restricting to POSTs is definitely not enough.

Thanks for letting me know.