This repository has been archived by the owner on Mar 29, 2022. It is now read-only.
Cve 2015 9284 #351
Merged
Cve 2015 9284 #351
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Temporary redirect page which may be momentarily shown:
|
This page automatically does a POST request with a valid CSRF token to auth/github. Contains fallback procedure if the JS fails for some reason.
|
I would like to test the |
johndbritton
approved these changes
Nov 7, 2019
Co-Authored-By: John Britton <public@johndbritton.com>
Co-Authored-By: John Britton <public@johndbritton.com>
mkcode
commented
Nov 7, 2019
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Original issue is described here: omniauth/omniauth#809
Note about the GitHub security altert: omniauth/omniauth#960
This is the proposed solution: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
...which we cannot use. We can't use this because we are redirecting to the authentication path in a before_filter, which triggers when the user is not logged in.
Redirects only work with GET requests and CSRF tokens only work with POST requests, so the fixes cannot apply here. This means we may need to totally redo the way we handle authentication in order to address this.
Alternatively, if we could call the omniauth request phase direct from our controller, we could not expose a GET route to the outside world, but because omniauth is implemented as a separate rack app, we are unable to do this.
We can use the method in the proposed solution on the wiki if we get rid of our redirect before_filter logic and only login in via forms. I'd really like to avoid this.
This issue has been open since 2015, and still not resolved upstream. I'm Ok with not fixing this for the time being.
PR is now ready to be merged. We implemented an html page, which automatically does a post request via JS to /auth/github