Eclipse Community Forums: Remote Application Platform (RAP) » RAP and Cross Site Request Forgery attacks

Help

Home

Home » Eclipse Projects » Remote Application Platform (RAP) » RAP and Cross Site Request Forgery attacks

Show: Today's Messages :: Show Polls :: Message Navigator

RAP and Cross Site Request Forgery attacks [message #1481881]

Fri, 21 November 2014 09:45

Lukasz Koniecki

Messages: 2
Registered: June 2011

Junior Member

I have a question about RAP and Cross Side Request Forgery attacks. Does RAP implement any prevention mechanism against such attacks?

I found virtually no information about RAP security neither in the official documentation nor in the internet.

The only reference in RAP 2.2.0 Release Notes:

Quote:

Bug 413668 - Cross Site Request Forgery vulnerability (aka CSRF/XSRF)

There is a reference to Bug 413668, but I get "You are not authorized to access bug #413668." error when trying to view it in Bugzilla.

Can you share some more information about RAP security in case of CSRF attacks?

Thanks in advance

Regards
luke

Report message to a moderator

Re: RAP and Cross Site Request Forgery attacks [message #1482138 is a reply to message #1481881]

Fri, 21 November 2014 14:24

Markus Knauer

Messages: 179
Registered: July 2009

Senior Member

Quote:

There is a reference to Bug 413668, but I get "You are not authorized to access bug #413668." error when trying to view it in Bugzilla.

I've enabled access to the bug report now. It was still hidden because it was a security releated bug, but it should have been made visible after fixing it. You should be able to review the discussion on the bug now.

Regards,
Markus

--

Twitter: @mknauer23 and @EclipseRAP
Blog: http://eclipsesource.com/blogs/

Professional services for RAP and RCP?
http://eclipsesource.com/services/rap/

Report message to a moderator

Re: RAP and Cross Site Request Forgery attacks [message #1485568 is a reply to message #1482138]

Mon, 24 November 2014 10:50

Lukasz Koniecki

Messages: 2
Registered: June 2011

Junior Member

Markus,

Thank's for sharing the bug report.

From what I understand from the bug report RAP only checks in REST services if Content-Type is set to application/json. No Synchronization Token has been implemented.

Is this true both for 2.1 and for 2.2 release? Any plans regarding the token for the 3.0 release?

Regards,
luke

Report message to a moderator

Previous Topic:	Custom Widget with Session Timeout
Next Topic:	Client error with Browser.execute function

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Fri Sep 20 07:32:25 GMT 2024

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter