920954 - Add CSRF token support

Status: RESOLVED FIXED

(Webmaker Graveyard :: Profile, defect)

Description

[Jon Buckley [:jbuck]]

I've disabled CSRF tokens temporarily so that we can continue to iterate on the frontend and backend, but we'll need to bring em back before we ship to prod.

Comment 1

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker-profile-service

https://github.com/mozilla/webmaker-profile-service/commit/5a440587535092213ebdb8f037fcaddfa23a7053
Bug 920954 - Disable CSRF token checking

Comment 2

[Chris DeCairos (:cade)]

I gave this a shot, and in my opinion, profile and profile service should be one app, otherwise we're going to have to figure out cross-domain csrf.

https://github.com/cadecairos/webmaker-profile-service/tree/bug920954
https://github.com/cadecairos/webmaker-profile/tree/bug920954

Comment 3

[Jon Buckley [:jbuck]]

I'll give myself 4 hours to figure out a way to do cross-domain csrf; if I can't then we can just merge the apps.

Comment 4

[Pomax]

I can't get a CSRF token to show up. If I add the server.use(express.csrf()) code after the cookie/body parsing, with a test route server.get('/getCSRF', function(req, res, next) { console.log(req.session); }); then there is no _csrf token, nor does req.csrfToken() resolve to anything valid. The session has a _csrfSecret attached to it, but this is not something we can use.

Comment 5

[Pomax]

Attachment: https://github.com/mozilla/webmaker-profile/pull/205

part 1 or 2 - other fix in https://github.com/mozilla/webmaker-profile-service/pull/24

Comment 6

[Pomax]

Attachment: https://github.com/mozilla/webmaker-profile-service/pull/24

part 2 of 2, other part is in https://github.com/mozilla/webmaker-profile/pull/205

Comment 7

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker-profile

https://github.com/mozilla/webmaker-profile/commit/fcfb5623aa27b3e4fcf31a20859ac6e7cd96911d
Merge pull request #205 from Pomax/bug920954

Bug920954

Comment 8

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker-profile-service

https://github.com/mozilla/webmaker-profile-service/commit/681062676438672188faf2858e622e26ec95e6b6
Merge pull request #24 from Pomax/bug920954

CSRF fixes