Re: CSRF Protection Bypass in Ruby on Rails - I don''t get it ...

Frederick Cheung
Wed, 09 Feb 2011 16:43:59 -0000

On Feb 9, 10:47 am, siebert
<siebertlu...-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org>
wrote:
> Hi all,
>
> My team and I are finding ourselves a little in the dark about the
> "CSRF Protection Bypass in Ruby on Rails" vulnerability that was
> announced yesterday
-http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby...
>
> 1. Where is the complete Advisory? The Impact section is very unclear.
> Looking at the comment in the 2.3 patch mentions "Flash animations and
> Java applets" - does the whole thing deserve a bit more explaining?

My take on this is that it had been previously thought safe to ignore
CSRF on ajax requests because the only requests that could set the
headers that identify a request as xhr were javascript requests. The
browser''s single origin policy means that those requests should in
theory not need the added protection of CSRF.
However flash & java applets can apparently make requests with
arbitrary headers and snarfing the session id at the same time

Fred

--
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk+unsubscribe@googlegroups.com.