Kraken.js CSRF Processing

Question

I have a problem with krakenjs, I am new to node / express.

krakenjs is configured to protect by default csrf (I know how to disable it, but I don't want to), but I don't know how to handle csrf and avoid 403 error.

in the ejs file i got this line.

<input type="hidden" name="_crsf" value="<%= _csrf %>" /> 

it generates the correct csrf, there is no problem.

and here is my route

 server.post('/isengard/fact/new', function(req,res){ var new_fact = Fact({ title : req.body.fact_title, description : req.body.fact_description, source : req.body.fact_source }); new_fact.save(function(err){ if(err) return handleError(err); var model = {status:true}; res.render('isengard/create',model); }); }); 

but when I submit the form (POST), I get this error.

 403 Error: Forbidden at Object.exports.error (/Users/onur/Documents/node/sage/node_modules/express/node_modules/connect/lib/utils.js:63:13) at createToken (/Users/onur/Documents/node/sage/node_modules/express/node_modules/connect/lib/middleware/csrf.js:82:55) at /Users/onur/Documents/node/sage/node_modules/express/node_modules/connect/lib/middleware/csrf.js:48:24 at csrf (/Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:112:13) at /Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:60:21 at xframe (/Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:131:9) at /Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:60:21 at p3p (/Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:144:9) at /Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:60:21 at Object.appsec (/Users/onur/Documents/node/sage/node_modules/kraken-js/node_modules/lusca/index.js:65:9) 

can someone explain me how to handle csrf?

Answer 1

Actually, your problem is that you have:

 <input type="hidden" name="_crsf" value="<%= _csrf %>" /> 

instead:

 <input type="hidden" name="_csrf" value="<%= _csrf %>" /> 

Notice the typo in the name attribute.

Answer 2

The trick is that you need to wrap your POST test inside the GET and analyze the desired CSRF token from the cookie.

Here is an example: fooobar.com/questions/446583 / ...

Answer 3

csrf in kraken is pretty much completely handled by the csrf connect middleware (with one add, the token is allocated to your views as _csrf ).

A bit more information would go a long way (req / res headers at least, but HAR would be awesome), but I can see this happen in several ways:

• The csrf secret (not a token, mind you) is restored or deleted for some time between the initial GET and POST . The only way this is possible is that the value stored as _csrfSecret in the session is changed or deleted between requests. Make sure your session is working correctly.

• One of the security headers gives you sadness. Try disabling it temporarily with something like the following in middleware-development.json :

   { "middleware": { "appsec": { "csp": false, "xframe": false, "p3p": false } } } 

Answer 4

If you don't need csrf protection, put this in your config.json to completely disable it. Then your application works as otherwise.

 "middleware": { "appsec": { "priority": 110, "module": { "name": "lusca", "arguments": [ { "csrf": false, "xframe": "SAMEORIGIN", "p3p": false, "csp": false } ] } }, }