Plack::Middleware::CSRFBlock - CSRF are never propageted to app
use Plack::Builder; my $app = sub { ... } builder { enable 'Session'; enable 'CSRFBlock'; $app; }
This middleware blocks CSRF. You can use this middleware without any modifications to your application, in most cases. Here is the strategy:
When the application response content-type is "text/html" or "application/xhtml+xml", this inserts hidden input tag that contains token string into forms in the response body. For example, the application response body is:
form
<html> <head><title>input form</title></head> <body> <form action="/receive" method="post"> <input type="text" name="email" /><input type="submit" /> </form> </html>
this becomes:
<html> <head><title>input form</title></head> <body> <form action="/api" method="post"><input type="hidden" name="SEC" value="0f15ba869f1c0d77" /> <input type="text" name="email" /><input type="submit" /> </form> </html>
This affects form tags with method="post", case insensitive.
method="post"
For every POST requests, this module checks input parameters contain the collect token parameter. If not found, throws 403 Forbidden by default.
Supports application/x-www-form-urlencoded and multipart/form-data.
application/x-www-form-urlencoded
multipart/form-data
use Plack::Builder; my $app = sub { ... } builder { enable 'Session'; enable 'CSRFBlock', parameter_name => 'csrf_secret', token_length => 20, session_key => 'csrf_token', blocked => sub { [302, [Location => 'http://www.google.com'], ['']]; }, onetime => 0, ; $app; }
Name of the input tag for the token.
Length of the token string. Max value is 40.
This middleware uses Plack::Middleware::Session for token storage. this is the session key for that.
The application called when CSRF is detected.
Note: This application can read posted data, but DO NOT use them!
If this is true, this middleware uses onetime token, that is, whenever client sent collect token and this middleware detect that, token string is regenerated.
This makes your applications more secure, but in many cases, is too strict.
This middleware doesn't work with pure Ajax POST request, because it cannot insert the token parameter to the request. We suggest, for example, to use jQuery Form Plugin like:
<script type="text/javascript" src="jquery.js"></script> <script type="text/javascript" src="jquery.form.js"></script> <form action="/api" method="post" id="theform"> ... blah ... </form> <script type="text/javascript> $('#theform').ajaxForm(); </script>
so, the middleware can insert token input tag next to form start tag, and the client can send it by Ajax form.
input
Rintaro Ishizaki <rintaro@cpan.org>
Plack::Middleware::Session
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
To install Plack::Middleware::CSRFBlock, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Plack::Middleware::CSRFBlock
CPAN shell
perl -MCPAN -e shell install Plack::Middleware::CSRFBlock
For more information on module installation, please visit the detailed CPAN module installation guide.