🚀 Feature: add CSRF tokens to protect from CSRF vulnerability

[usamashafiqs]

🔖 Feature description

What is a CSRF token?

A CSRF Token is a secret, unique and unpredictable value a server-side application generates in order to protect CSRF vulnerable resources.

The tokens are generated and submitted by the server-side application in a subsequent HTTP request made by the client.

After the request is made, the server side application compares the two tokens found in the user session and in the request. If the token is missing or does not match the value within the user session, the request is rejected, the user session terminated and the event logged as a potential CSRF attack.

🎤 Pitch

How should CSRF tokens be generated?

Just like session tokens in general, CSRF tokens should contain significant entropy and be strongly unpredictable.

You can achieve this by using a cryptographic strength pseudo-random number generator (PRNG), seeded with the timestamp when it was created and a static secret.

For further security, you can generate individual tokens by chaining their outputs with user-specific entropy and take a strong hash of the whole structure.

This presents an additional obstacle to a malicious user who attempts to analyze the tokens based on a sample that is issued to him.

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

[stnguyen90]

@usamashafiqs thanks for raising this issue! 🙏🏼

[stnguyen90]

@usamashafiqs, as far as I'm aware, CSRF requires an attacker to host a malicious form and trick a user to browse to the from. The form would then auto-submit using the Appwrite cookie.

Appwrite should be safe because we check the origin header and block the request if it isn't a registered application.

Is there anything I'm missing?

[usamashafiqs]

@stnguyen90 watch this https://www.youtube.com/watch?v=80S8h5hEwTY

[stnguyen90]

@usamashafiqs, thanks for providing that. Are you able to build a POC that would perform a CSRF against Appwrite?

[stnguyen90]

@usamashafiqs feel free to report a vulnerability if you're able to put together a POC.