Hi Jan-Wij,

+1 for implementing convenient CSRF.

I wonder if you could make your implementation more orthogonal by implementing a CSRF "field/widget", and make your `protected` attribute simply trigger the inclusion of this field implicitly.

This way you wouldn't need to change the `*pageform.pt` templates like you do now, and `setupToken()`/`checkToken()` would move to the widget code.

Cheers,

Leo

On Wed, Sep 18, 2013 at 11:41 AM, Jan-Wijbrand Kolman <janwijbrand@gmail.com

wrote:

Hi,

I've been working on CSRF protection for zope.formlib.

I have a "csrfprotection" branch in my zope.formlib fork on github. The changes against the current zope.formlib mainline can be found here:

https://github.com/**janwijbrand/zope.formlib/**compare/csrfprotectionhttps://github.com/janwijbrand/zope.formlib/compare/csrfprotection

When creating form components based on zope.formlib.form.FormBase, one can enable this protection just by setting the attribute ``protected`` to True on the component.

This implementation is based on the following assumptions:

• We do not want to keep server-side state(!)

• An "attacker" that attempts CSRF cannot get to information stored in

cookies that are meant for the domain of the (forged) request.

• The token stored in the cookie is sufficiently random and long, to be

practically "unguessable" by the attacker.

• The form submit is deemed valid as long as the token in the cookie is

identical to a hidden input value that is part of the form submit.

My questions:

• Do you find this feature useful enough to be, in principle, included in

zope.formlib?

• I'd like to kindly request someone to review my branch and provide

feedback.

The included test cases describe a few more questions and concerns about this implementation.

Thank you in advance!

kind regards, jw

______________________________**_________________ Zope-Dev maillist - Zope-Dev@zope.org https://mail.zope.org/mailman/**listinfo/zope-devhttps://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - https://mail.zope.org/mailman/**listinfo/zope-announcehttps://mail.zope.org/mailman/listinfo/zope-announce https://mail.zope.org/mailman/**listinfo/zopehttps://mail.zope.org/mailman/listinfo/zope)

On 9/18/13 4:41 PM, Jan-Wijbrand Kolman wrote:

I've been working on CSRF protection for zope.formlib.

Anyone else interested in this feature?

We made an internal release of zope.formlib with this functionality and so far we found no issues in using it in production.

After updating zope.formlib's tests to also run on Python 3, I could merge this feature soon. Unless of course, someone objects :-)

kind regards, jw