| csrfprotector.php | |
| Variables | |
| $cookieExpiryTime | expiry time for cookie @var int |
| $isSameOrigin | flag for cross origin/same origin request @var bool |
| $isValidHTML | flag to check if output file is a valid HTML or not @var bool |
| $requestType | Varaible to store weather request type is post or get @var string |
| $config | config file for CSRFProtector @var int Array, length = 6 Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails Property: #2: logDirectory (string) => directory in which log will be saved Property: #3: customErrorMessage (string) => custom error message to be sent in case of failed authentication Property: #4: jsFile (string) => location of the CSRFProtector js file Property: #5: tokenLength (int) => default length of hash Property: #6: disabledJavascriptMessage (string) => error message if client’s js is disabled |
| Functions | |
| init | function to initialise the csrfProtector work flow |
| useCachedVersion | function to check weather to use cached version of js file or not |
| createNewJsCache | Function to create new cache version of js |
| authorisePost | function to authorise incoming post requests |
| failedValidationAction | function to be called in case of failed validation performs logging and take appropriate action |
| refreshToken | Function to set auth cookie |
| generateAuthToken | function to generate random hash of length as given in parameter max length = 128 |
| ob_handler | Rewrites <form> on the fly to add CSRF tokens to them. |
| logCSRFattack | Functio to log CSRF Attack |
| getCurrentUrl | Function to return current url of executing page |
| isURLallowed | Function to check if a url mataches for any urls Listed in config file |
public static $config
config file for CSRFProtector @var int Array, length = 6 Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails Property: #2: logDirectory (string) => directory in which log will be saved Property: #3: customErrorMessage (string) => custom error message to be sent in case of failed authentication Property: #4: jsFile (string) => location of the CSRFProtector js file Property: #5: tokenLength (int) => default length of hash Property: #6: disabledJavascriptMessage (string) => error message if client’s js is disabled
public static function init( $length = null, $action = null )
function to initialise the csrfProtector work flow
| $length | length of CSRF_AUTH_TOKEN to be generated |
| $action | int array, for different actions to be taken in case of failed validation |
void
| configFileNotFoundException | when configuration file is not found |
expiry time for cookie @var int
public static $cookieExpiryTime
flag for cross origin/same origin request @var bool
private static $isSameOrigin
flag to check if output file is a valid HTML or not @var bool
private static $isValidHTML
Varaible to store weather request type is post or get @var string
protected static $requestType
config file for CSRFProtector @var int Array, length = 6 Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails Property: #2: logDirectory (string) => directory in which log will be saved Property: #3: customErrorMessage (string) => custom error message to be sent in case of failed authentication Property: #4: jsFile (string) => location of the CSRFProtector js file Property: #5: tokenLength (int) => default length of hash Property: #6: disabledJavascriptMessage (string) => error message if client’s js is disabled
public static $config
function to initialise the csrfProtector work flow
public static function init( $length = null, $action = null )
function to check weather to use cached version of js file or not
public static function useCachedVersion()
Function to create new cache version of js
public static function createNewJsCache()
function to authorise incoming post requests
public static function authorisePost()
function to be called in case of failed validation performs logging and take appropriate action
private static function failedValidationAction()
Function to set auth cookie
public static function refreshToken()
function to generate random hash of length as given in parameter max length = 128
public static function generateAuthToken()
Rewrites form on the fly to add CSRF tokens to them.
public static function ob_handler( $buffer, $flags )
Functio to log CSRF Attack
private static function logCSRFattack()
Function to return current url of executing page
private static function getCurrentUrl()
Function to check if a url mataches for any urls Listed in config file
public static function isURLallowed()
| C | |
| csrfprotector.php |
| A | |
| authorisePost | |
| C | |
| createNewJsCache | |
| F | |
| failedValidationAction | |
| G | |
| generateAuthToken | |
| getCurrentUrl | |
| I | |
| init | |
| isURLallowed | |
| L | |
| logCSRFattack | |
| O | |
| ob_handler | |
| R | |
| refreshToken | |
| U | |
| useCachedVersion |
function to authorise incoming post requests
public static function authorisePost()
Function to create new cache version of js
public static function createNewJsCache()
function to be called in case of failed validation performs logging and take appropriate action
private static function failedValidationAction()
function to generate random hash of length as given in parameter max length = 128
public static function generateAuthToken()
Function to return current url of executing page
private static function getCurrentUrl()
function to initialise the csrfProtector work flow
public static function init( $length = null, $action = null )
Function to check if a url mataches for any urls Listed in config file
public static function isURLallowed()
Functio to log CSRF Attack
private static function logCSRFattack()
Rewrites form on the fly to add CSRF tokens to them.
public static function ob_handler( $buffer, $flags )
Function to set auth cookie
public static function refreshToken()
function to check weather to use cached version of js file or not
public static function useCachedVersion()
function to authorise incoming post requests
public static function authorisePost()
config file for CSRFProtector @var int Array, length = 6 Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails Property: #2: logDirectory (string) => directory in which log will be saved Property: #3: customErrorMessage (string) => custom error message to be sent in case of failed authentication Property: #4: jsFile (string) => location of the CSRFProtector js file Property: #5: tokenLength (int) => default length of hash Property: #6: disabledJavascriptMessage (string) => error message if client’s js is disabled
public static $config
expiry time for cookie @var int
public static $cookieExpiryTime
Function to create new cache version of js
public static function createNewJsCache()
function to be called in case of failed validation performs logging and take appropriate action
private static function failedValidationAction()
function to generate random hash of length as given in parameter max length = 128
public static function generateAuthToken()
Function to return current url of executing page
private static function getCurrentUrl()
function to initialise the csrfProtector work flow
public static function init( $length = null, $action = null )
flag for cross origin/same origin request @var bool
private static $isSameOrigin
Function to check if a url mataches for any urls Listed in config file
public static function isURLallowed()
flag to check if output file is a valid HTML or not @var bool
private static $isValidHTML
Functio to log CSRF Attack
private static function logCSRFattack()
Rewrites form on the fly to add CSRF tokens to them.
public static function ob_handler( $buffer, $flags )
Function to set auth cookie
public static function refreshToken()
Varaible to store weather request type is post or get @var string
protected static $requestType
function to check weather to use cached version of js file or not
public static function useCachedVersion()
| C | |
| $ | config |
| $ | cookieExpiryTime |
| I | |
| $ | isSameOrigin |
| $ | isValidHTML |
| R | |
| $ | requestType |
config file for CSRFProtector @var int Array, length = 6 Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails Property: #2: logDirectory (string) => directory in which log will be saved Property: #3: customErrorMessage (string) => custom error message to be sent in case of failed authentication Property: #4: jsFile (string) => location of the CSRFProtector js file Property: #5: tokenLength (int) => default length of hash Property: #6: disabledJavascriptMessage (string) => error message if client’s js is disabled
public static $config
expiry time for cookie @var int
public static $cookieExpiryTime
flag for cross origin/same origin request @var bool
private static $isSameOrigin
flag to check if output file is a valid HTML or not @var bool
private static $isValidHTML
Varaible to store weather request type is post or get @var string
protected static $requestType
Note: Missing tick means, this has not yet been implemented or tested14 | 15 | 16 | -------------------------------------------------------------------------------- /js/csrfprotector.js: -------------------------------------------------------------------------------- 1 | /** 2 | * ================================================================= 3 | * Javascript code for OWASP CSRF Protector 4 | * Task it does: Fetch csrftoken from cookie, and attach it to every 5 | * POST request 6 | * Allowed GET url 7 | * -- XHR 8 | * -- Static Forms 9 | * -- URLS (GET only) 10 | * -- dynamic forms 11 | * ================================================================= 12 | */ 13 | 14 | var CSRFP_FIELD_TOKEN_NAME = 'csrfp_hidden_data_token'; 15 | var CSRFP_FIELD_URLS = 'csrfp_hidden_data_urls'; 16 | 17 | var CSRFP = { 18 | CSRFP_TOKEN: 'CSRFP-Token', 19 | /** 20 | * Array of patterns of url, for which csrftoken need to be added 21 | * In case of GET request also, provided from server 22 | * 23 | * @var {Array} 24 | */ 25 | checkForUrls: [], 26 | /** 27 | * Returns true if the get request doesn't need csrf token. 28 | * 29 | * @param {String} url to check. 30 | * @return {Boolean} true if csrftoken is not needed. 31 | */ 32 | _isValidGetRequest: function (url) { 33 | for (var i = 0; i < CSRFP.checkForUrls.length; i++) { 34 | var match = CSRFP.checkForUrls[i].exec(url); 35 | if (match !== null && match.length > 0) { 36 | return false; 37 | } 38 | } 39 | return true; 40 | }, 41 | /** 42 | * Returns auth key from cookie. 43 | * 44 | * @return {String} auth key from cookie. 45 | */ 46 | _getAuthKey: function () { 47 | var regex = new RegExp(`(?:^|;\s*)${CSRFP.CSRFP_TOKEN}=([^;]+)(;|$)`); 48 | var regexResult = regex.exec(document.cookie); 49 | if (regexResult === null) { 50 | return null; 51 | } 52 | 53 | return regexResult[1]; 54 | }, 55 | /** 56 | * Returns domain name of a url. 57 | * 58 | * @param {String} url - url to check. 59 | * @return {String} domain of the input url. 60 | */ 61 | _getDomain: function (url) { 62 | // TODO(mebjas): add support for other protocols that web supports. 63 | if (url.indexOf('http://') !== 0 && url.indexOf('https://') !== 0) { 64 | return document.domain; 65 | } 66 | return /http(s)?:\/\/([^\/]+)/.exec(url)[2]; 67 | }, 68 | /** 69 | * Creates hidden input element with CSRF_TOKEN in it. 70 | * 71 | * @return {HTMLInputElement} hidden input element. 72 | */ 73 | _createHiddenInputElement: function () { 74 | var inputElement = document.createElement('input'); 75 | inputElement.setAttribute('name', CSRFP.CSRFP_TOKEN); 76 | inputElement.setAttribute('class', CSRFP.CSRFP_TOKEN); 77 | inputElement.type = 'hidden'; 78 | inputElement.value = CSRFP._getAuthKey(); 79 | return inputElement; 80 | }, 81 | /** 82 | * Returns absolute url from the input relative components. 83 | * 84 | * @param {String} basePart - base part of the url. 85 | * @param {String} relativePart - relative part of the url. 86 | * @return {String} absolute url. 87 | */ 88 | _createAbsolutePath: function (basePart, relativePart) { 89 | var stack = basePart.split("/"); 90 | var parts = relativePart.split("/"); 91 | stack.pop(); 92 | 93 | for (var i = 0; i < parts.length; i++) { 94 | if (parts[i] === ".") { 95 | continue; 96 | } 97 | if (parts[i] === "..") { 98 | stack.pop(); 99 | } else { 100 | stack.push(parts[i]); 101 | } 102 | } 103 | return stack.join("/"); 104 | }, 105 | /** 106 | * Creates a function wrapper around {@param runnableFunction}, removes 107 | * CSRF Token before calling the function and then put it back. 108 | * 109 | * @param {Function} runnableFunction - function to run. 110 | * @param {Object} htmlFormObject - reference form object. 111 | * @return modified wrapped function. 112 | */ 113 | _createCsrfpWrappedFunction: function (runnableFunction, htmlFormObject) { 114 | return function (event) { 115 | // Remove CSRf token if exists 116 | if (typeof htmlFormObject[CSRFP.CSRFP_TOKEN] !== 'undefined') { 117 | var target = htmlFormObject[CSRFP.CSRFP_TOKEN]; 118 | target.parentNode.removeChild(target); 119 | } 120 | 121 | // Trigger the functions 122 | var result = runnableFunction.apply(this, [event]); 123 | 124 | // Now append the CSRFP-Token back 125 | htmlFormObject.appendChild(CSRFP._createHiddenInputElement()); 126 | return result; 127 | }; 128 | }, 129 | /** 130 | * Initialises the CSRFProtector js script. 131 | */ 132 | _init: function () { 133 | this.CSRFP_TOKEN = document.getElementById( 134 | CSRFP_FIELD_TOKEN_NAME).value; 135 | 136 | try { 137 | var csrfFieldElem = document.getElementById(CSRFP_FIELD_URLS); 138 | this.checkForUrls = JSON.parse(csrfFieldElem.value); 139 | } catch (exception) { 140 | console.error(exception); 141 | console.error('[ERROR] [CSRF Protector] unable to parse blacklisted' 142 | + ` url fields. Exception = ${exception}`); 143 | } 144 | 145 | // Convert the rules received from php library to regex objects. 146 | for (var i = 0; i < CSRFP.checkForUrls.length; i++) { 147 | this.checkForUrls[i] 148 | = this.checkForUrls[i].replace(/\*/g, '(.*)') 149 | .replace(/\//g, "\\/"); 150 | this.checkForUrls[i] = new RegExp(CSRFP.checkForUrls[i]); 151 | } 152 | } 153 | } 154 | 155 | //========================================================== 156 | // Adding tokens, wrappers on window onload 157 | //========================================================== 158 | 159 | function csrfprotector_init() { 160 | 161 | // Call the init function 162 | CSRFP._init(); 163 | 164 | // Basic FORM submit event handler to intercept the form request and attach 165 | // a CSRFP TOKEN if it's not already available. 166 | var basicSubmitInterceptor = function (event) { 167 | if (!event.target[CSRFP.CSRFP_TOKEN]) { 168 | event.target.appendChild(CSRFP._createHiddenInputElement()); 169 | } else { 170 | //modify token to latest value 171 | event.target[CSRFP.CSRFP_TOKEN].value = CSRFP._getAuthKey(); 172 | } 173 | }; 174 | 175 | //================================================================== 176 | // Adding csrftoken to request resulting from