Cross Site Request Forgery

Since version 2.4.x we have added the cbcsrf module as a dependency of cbSecurity.  Below is how you can use it:
Settings
Below are the settings you can use for this module. Remember you must create the cbcsrf struct in your ColdBox.cfc under the moduleSettings structure:
1
moduleSettings = {
2
    cbcsrf : {
3
        // By default we load up an interceptor that verifies all non-GET incoming requests against the token validations
4
			enableAutoVerifier     : false,
5
			// A list of events to exclude from csrf verification, regex allowed: e.g. stripe\..*
6
			verifyExcludes         : [],
7
			// By default, all csrf tokens have a life-span of 30 minutes. After 30 minutes, they expire and we aut-generate new ones.
8
			// If you do not want expiring tokens, then set this value to 0
9
			rotationTimeout        : 30,
10
			// Enable the /cbcsrf/generate endpoint to generate cbcsrf tokens for secured users.
11
			enableEndpoint         : false,
12
			// The WireBox mapping to use for the CacheStorage
13
			cacheStorage           : "[email protected]",
14
			// Enable/Disable the cbAuth login/logout listener in order to rotate keys
15
			enableAuthTokenRotator : false
16
    }
17
};
Copied!
Mixins
This module will add the following UDF mixins to handlers, interceptors, layouts and views:
csrfToken() : To generate a token, using the default or a custom key
csrfVerify() : Verify a valid token or not
csrf() : To generate a hidden field (csrf) with the token
csrfField() : Generate a random token in a hidden form element and javascript that will refresh the page automatically when the token expires
csrfRotate() : To wipe and rotate the tokens for the user
Here are the method signatures:
1
/**
2
 * Provides a random token and stores it in the coldbox cache storages. You can also provide a specific key to store.
3
 *
4
 * @key A random token is generated for the key provided.
5
 * @forceNew If set to true, a new token is generated every time the function is called. If false, in case a token exists for the key, the same key is returned.
6
 *
7
 * @return csrf token
8
 */
9
string function csrfToken( string key='', boolean forceNew=false )
10
​
11
/**
12
 * Validates the given token against the same stored in the session for a specific key.
13
 *
14
 * @token Token that to be validated against the token stored in the session.
15
 * @key The key against which the token be searched.
16
 *
17
 * @return Valid or Invalid Token
18
 */
19
boolean function csrfVerify( required string token='', string key='' )
20
​
21
/**
22
 * Generate a random token and build a hidden form element so you can submit it with your form
23
 *
24
 * @key A random token is generated for the key provided.
25
 * @forceNew If set to true, a new token is generated every time the function is called. If false, in case a token exists for the key, the same key is returned.
26
 *
27
 * @return HTML of the hidden field (csrf)
28
 */
29
string function csrf( string key='', boolean forceNew=false )
30
​
31
/**
32
 * Generate a random token in a hidden form element and javascript that will refresh the page automatically when the token expires
33
 * 
34
 * @key A random token is generated for the key provided. CFID is the default
35
 * @forceNew If set to true, a new token is generated every time the function is called. If false, in case a token exists for the key, the same key is returned.
36
 *
37
 * @return HTML of the hidden field (csrf)
38
 */
39
string function csrfField( string key='', boolean forceNew=false )
40
​
41
/**
42
 * Clears out all csrf token stored
43
 */
44
function csrfRotate()
Copied!
Mappings
The module also registers the following mapping in WireBox: @cbcsrf so you can call our service model directly.
1
component{
2
​
3
    property name="cbcsrf" inject="@cbcsrf";
4
    
5
}
Copied!
Automatic Token Expiration
By default, the module is configured to rotate all user csrf tokens every 30 minutes. This means that every token that gets created has a maximum life-span of {rotationTimeout} minutes. If you do NOT want the tokens to EVER expire during the user's logged in session, then use the value of 0 zero.
It is recommended to rotate your keys often, in case your token get's compromised.
Token Rotation
We have provided several methods to rotate or clear out all of a user's tokens. If you are using cbAuth as your module of choice for authentication, then we will listen to logins and logouts and rotate the keys for you if you have enabled the enableAuthTokenRotator setting.
1
moduleSettings = {
2
    cbcsrf : {
3
			// Enable/Disable the cbAuth login/logout listener in order to rotate keys
4
			enableAuthTokenRotator : true
5
    }
6
};
Copied!
If you are NOT using cbAuth then we recommend you leverage the csrfRotate() mixin or the cbsrf.rotate() method on the @cbsrf model and do the manual rotation yourself.
handlers/security.cfc
1
component{
2
​
3
    function doLogin( event, rc, prc ){
4
    
5
        if( valid login ){
6
            // login user
7
            csrfRotate();
8
        }
9
    }
10
    
11
    function logout( event, rc, prc  ){
12
        csrfRotate();
13
    }
14
​
15
}
Copied!
Simple Example
Below is a simple example of manually verifying tokens in your handlers:
registration.cfc
1
component extends="coldbox.system.EventHandler"{
2
​
3
     function signUp( event, rc, prc ){
4
        // Store this in a hidden field in the form
5
        prc.token = csrfGenerate();
6
        event.setView( "registration/signup" );
7
    }
8
​
9
     function signUpProcess( event, rc, prc ){
10
        // Verify CSFR token from form
11
        if( csrfVerify( rc.token ?: '' ) {
12
            // save form
13
        } else {
14
            // Something isn't right
15
            relocate( 'handler.signup' );
16
        }
17
    }
18
}
Copied!
Automatic Token Verifier
We have included an interceptor that if loaded will verify all incoming requests to make sure the token has been passed or it will throw an exception.
The settings for this feature are:
1
cbcsrf : {
2
    // Enable the verifier
3
    enableAutoVerifier : true,
4
    
5
    // A list of events to exclude from csrf verification, regex allowed: e.g. stripe\..*
6
    verifyExcludes : [
7
    
8
    ]
9
}
Copied!
You can also register an array of regular expressions that will be tested against the incoming event and if matched, it will allow the request through with no verification.
The verification process is as follows:
If we are doing an integration test, then skip verification
If the incoming HTTP Method is a get,options or head skip verification
If the incoming event matches any of the verifyExcludes setting, then skip verification
If the action is marked with a skipCsrf annotation, then skip verification
If no rc.csrf exists and no x-csrf-token header exists, throw a 
TokenNotFoundException exception
If the token is invalid then throw a TokenMismatchException exception
Please note that this verifier will check the following locations for the token:
1.The request collection (rc) via the cbcsrf key
2.The request HTTP header (x-csrf-token) key
skipCsrf Annotation
You can also annotate your event handler actions with a skipCsrf annotation and the verifier will also skip the verification process for those actions.
1
component{
2
​
3
    function doTestSave( event, rc, prc ) skipCsrf{
4
​
5
​
6
    }
7
​
8
}
Copied!
/cbcsrf/generate Endpoint
This module also allows you to turn on the generation HTTP endpoint via the enableEndpoint boolean setting. When turned on the module will register the following route: GET /cbcsrf/generate/:key?. You can use this endpoint to generate tokens for your users via AJAX or UI only applications. Please note that you can pass an optional /:key URL parameter that will generate the token for that specific key.
This endpoint should be secured, so we have annotated it with a secured annotation so if you are using cbSecurity or cbGuard this endpoint will only be available to logged in users.