Hi,
I've been working on CSRF protection for zope.formlib.
I have a "csrfprotection" branch in my zope.formlib fork on github. The
changes against the current zope.formlib mainline can be found here:
https://github.com/janwijbrand/zope.formlib/compare/csrfprotection
When creating form components based on zope.formlib.form.FormBase, one
can enable this protection just by setting the attribute ``protected``
to True on the component.
This implementation is based on the following assumptions:
* We do not want to keep server-side state(!)
* An "attacker" that attempts CSRF cannot get to information stored in
cookies that are meant for the domain of the (forged) request.
* The token stored in the cookie is sufficiently random and long, to be
practically "unguessable" by the attacker.
* The form submit is deemed valid as long as the token in the cookie is
identical to a hidden input value that is part of the form submit.
My questions:
* Do you find this feature useful enough to be, in principle, included
in zope.formlib?
* I'd like to kindly request someone to review my branch and provide
feedback.
The included test cases describe a few more questions and concerns about
this implementation.
Thank you in advance!
kind regards, jw
This is the summary for test reports received on the
zope-tests list between 2013-09-29 00:00:00 UTC and 2013-09-30 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 413
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
This is the summary for test reports received on the
zope-tests list between 2013-09-28 00:00:00 UTC and 2013-09-29 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 412
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
This is the summary for test reports received on the
zope-tests list between 2013-09-27 00:00:00 UTC and 2013-09-28 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 411
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
This is the summary for test reports received on the
zope-tests list between 2013-09-26 00:00:00 UTC and 2013-09-27 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 410
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
This is the summary for test reports received on the
zope-tests list between 2013-09-24 00:00:00 UTC and 2013-09-25 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 408
[1] winbot / zope.app.wsgi_py_265_32
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
[1] FAILED winbot / zope.app.wsgi_py_265_32
https://mail.zope.org/pipermail/zope-tests/2013-September/078930.html
This is the summary for test reports received on the
zope-tests list between 2013-09-23 00:00:00 UTC and 2013-09-24 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
Successful - zopetoolkit_trunk - Build # 407
[1] winbot / zope.app.wsgi_py_265_32
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
[1] FAILED winbot / zope.app.wsgi_py_265_32
https://mail.zope.org/pipermail/zope-tests/2013-September/078913.html
This is the summary for test reports received on the
zope-tests list between 2013-09-22 00:00:00 UTC and 2013-09-23 00:00:00 UTC:
See the footnotes for test reports of unsuccessful builds.
An up-to date view of the builders is also available in our
buildbot documentation:
http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds
Reports received
----------------
winbot / ztk_10 py_254_win32
winbot / ztk_10 py_265_win32
winbot / ztk_10 py_265_win64
winbot / ztk_11 py_254_win32
winbot / ztk_11 py_265_win32
winbot / ztk_11 py_265_win64
[1] winbot / ztk_11 py_270_win32
winbot / ztk_11 py_270_win64
Non-OK results
--------------
[1] FAILED winbot / ztk_11 py_270_win32
https://mail.zope.org/pipermail/zope-tests/2013-September/078904.html