Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSRF Failing due to Context.Request().URL not containing host #64

Open
Thelvaen opened this issue Nov 23, 2020 · 3 comments
Open

CSRF Failing due to Context.Request().URL not containing host #64

Thelvaen opened this issue Nov 23, 2020 · 3 comments

Comments

@Thelvaen
Copy link
Contributor

Describe the bug
Hello,
After playing with CSRF & HTTPS, it seems that Context.Request().URL is not correctly filled, hence failing the referrer check at that line:

			valid := sameOrigin(ctx.Request().URL, referer)

To Reproduce
Steps to reproduce the behavior:

  1. Print the Context.Request().URL.Scheme or .Host when inside a middleware

Expected behavior
We should get part of the URL depending on below schema:
scheme://host.domain:port/path/to/request

actually we're only getting the path part
/path/to/request

Screenshots
see attached screenshot if it helps
ctx.Request().URL showing the path
issue_csrf

trying to query ctx.Request().URL.Host
issue_csrf

Desktop (please complete the following information):

  • Client is running Windows 10,
  • Server is running Raspbian 10,

iris.Version

  • e.g. v12.2.0-alpha

Additional context
Add any other context about the problem here.

@Thelvaen Thelvaen changed the title CSRF Failing du to Context.Request().URL not containing host CSRF Failing due to Context.Request().URL not containing host Nov 23, 2020
@Thelvaen
Copy link
Contributor Author

Note : I tried running it on my Windows 10 computer, and accessing it from other devices, and the issue is still the same.

@Thelvaen
Copy link
Contributor Author

further test seems to pinpoint the issue with the "net/http" package

package main

import (
    "fmt"
    "net/http"
)

func hello(w http.ResponseWriter, req *http.Request) {
    fmt.Printf("request from : %s\n", req.RemoteAddr)
    status := ""
    if req.TLS == nil {
        status = "not used"
    } else {
        status = "used"
    }
    fmt.Printf("TLS Status : %s\n", status)
    fmt.Print("req.URL.Host : ")
    fmt.Println(req.URL.Host)
    fmt.Print("req.URL.Rawquery : ")
    fmt.Println(req.URL.RawQuery)
}

func main() {
    http.HandleFunc("/hello", hello)
    go http.ListenAndServe("192.168.0.20:8080", nil)
    http.ListenAndServeTLS("192.168.0.20:8090", "fullchain.pem", "privkey.pem", nil)
}

and accessing the pages from a other device on my network:

C:\Users\thelv\go\src\github.com\Thelvaen\test>go run main.go
request from : 192.168.0.199:47910
TLS Status : used
req.URL.Host :
req.URL.Rawquery :
2020/11/23 15:39:45 http: TLS handshake error from 192.168.0.199:47908: remote error: tls: unknown certificate
2020/11/23 15:39:52 http: TLS handshake error from 192.168.0.199:47906: remote error: tls: unknown certificate
request from : 192.168.0.199:39766
TLS Status : not used
req.URL.Host :
req.URL.Rawquery :

@Thelvaen
Copy link
Contributor Author

Note : I found that they had an old issue : golang/go#3805 for this on net/http, and yeah, they don't fill the request.URL parts, so I will try to provide a merge request fixing the behavior later today

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant