octoleo/syncthing
1
0
Fork 0
mirror of https://github.com/octoleo/syncthing.git synced 2024-12-31 14:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

CSRF protection should only cover /rest

Browse Source
This commit is contained in:
Jakob Borg 2014-07-06 15:00:44 +02:00
parent 31350b4352
commit b7ea695caf
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cmd/syncthing/gui.go
View File

@ -126,8 +126,9 @@ func startGUI(cfg config.GUIConfiguration, assetDir string, m *model.Model) erro
mux.HandleFunc("/", embeddedStatic)
}
// Wrap everything in CSRF protection
handler := csrfMiddleware(mux)
// Wrap everything in CSRF protection. The /rest prefix should be
// protected, other requests will grant cookies.
handler := csrfMiddleware("/rest", mux)
// Wrap everything in basic auth, if user/password is set.
if len(cfg.User) > 0 {

5
cmd/syncthing/gui_csrf.go
View File

@ -8,6 +8,7 @@ import (
"net/http"
"os"
"path/filepath"
"strings"
"sync"
"time"
@ -20,7 +21,7 @@ var csrfMut sync.Mutex
// Check for CSRF token on /rest/ URLs. If a correct one is not given, reject
// the request with 403. For / and /index.html, set a new CSRF cookie if none
// is currently set.
func csrfMiddleware(next http.Handler) http.Handler {
func csrfMiddleware(prefix string, next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Allow requests carrying a valid API key
if validAPIKey(r.Header.Get("X-API-Key")) {
@ -29,7 +30,7 @@ func csrfMiddleware(next http.Handler) http.Handler {
}
// Allow requests for the front page, and set a CSRF cookie if there isn't already a valid one.
if r.URL.Path == "/" || r.URL.Path == "/index.html" {
if !strings.HasPrefix(r.URL.Path, prefix) {
cookie, err := r.Cookie("CSRF-Token")
if err != nil || !validCsrfToken(cookie.Value) {
cookie = &http.Cookie{