880890 - Implement CSRF protection for Thimble

Status: RESOLVED FIXED

(Webmaker Graveyard :: Thimble, defect)

Description

[Jon Buckley [:jbuck]]

Thimble-node needs CSRF protection now that it has user accounts.

Comment 1

[Pomax]

Attachment: https://github.com/mozilla/thimble.webmaker.org/pull/105

Comment 2

[Jon Buckley [:jbuck]]

Comment on attachment 760449 [details] [review]
https://github.com/mozilla/thimble.webmaker.org/pull/105

Reassigning to Matt

Comment 3

[Matthew Schranz [:mjschranz]]

Comment on attachment 760449 [details] [review]
https://github.com/mozilla/thimble.webmaker.org/pull/105

I had a really minor nit.

Other than that, I'm fairly confident in saying this is good to go. Locally SSO worked just fine. I don't know if there are any other spots in Thimble's code where we want to pass the CSRF token along but yeah.

R+

Comment 4

[Pomax]

There's only two places where we render html, and the second place is the (temporary) gallery page that we're not actually surfacing in the tool (it's there for administrative purposes atm). I'll fix the code based on your suggestion, then land it after Travis clears it.

Comment 5

[[github robot]]

Commit pushed to master at https://github.com/mozilla/thimble.webmaker.org

https://github.com/mozilla/thimble.webmaker.org/commit/dafd92b1731f4a4c0760f0659b627a395648f7d7
Merge pull request #105 from Pomax/bug880890

Added CSRF protection to Thimble

Comment 6

[Pomax]

landed.