7716fac58d
This patch adds Koha::REST::Plugin::CSRF which enforces CSRF token validation on state-changing requests (POST/PUT/DELETE/PATCH) when a CGISESSID cookie is present. Requests using OAuth2 or HTTP Basic Auth are not affected since they don't use session cookies and are inherently immune to CSRF. The client-side already sends the CSRF-TOKEN header via http-client.js (added in Bug 34478). This patch adds the server-side enforcement. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/REST/Plugin/CSRF.t => SUCCESS: Tests pass! 3. Run: k$ prove t/db_dependent/api/v1/csrf.t => SUCCESS: Tests pass! 4. Tests cover: - GET/HEAD/OPTIONS requests bypass CSRF check - POST/PUT/DELETE without CGISESSID bypass CSRF check - POST with CGISESSID but no CSRF-TOKEN returns 403 - POST with CGISESSID and invalid CSRF-TOKEN returns 403 - POST with CGISESSID and valid CSRF-TOKEN passes through - PUT and DELETE enforcement 5. Sign off :-D Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> |
||
|---|---|---|
| .. | ||
| Auth | ||
| CSRF.pm | ||
| Exceptions.pm | ||
| Objects.pm | ||
| Pagination.pm | ||
| PluginRoutes.pm | ||
| Query.pm | ||
| Responses.pm | ||