Skip to main content


Eclipse Community Forums

      Home
Home » Eclipse Projects » Remote Application Platform (RAP) » RAP and Cross Site Request Forgery attacks
RAP and Cross Site Request Forgery attacks [message #1481881] Fri, 21 November 2014 04:45 Go to next message
Eclipse UserFriend
I have a question about RAP and Cross Side Request Forgery attacks. Does RAP implement any prevention mechanism against such attacks?

I found virtually no information about RAP security neither in the official documentation nor in the internet.

The only reference in RAP 2.2.0 Release Notes:

Quote:

Bug 413668 - Cross Site Request Forgery vulnerability (aka CSRF/XSRF)


There is a reference to Bug 413668, but I get "You are not authorized to access bug #413668." error when trying to view it in Bugzilla.

Can you share some more information about RAP security in case of CSRF attacks?

Thanks in advance

Regards
luke
Re: RAP and Cross Site Request Forgery attacks [message #1482138 is a reply to message #1481881] Fri, 21 November 2014 09:24 Go to previous messageGo to next message
Eclipse UserFriend
Quote:
There is a reference to Bug 413668, but I get "You are not authorized to access bug #413668." error when trying to view it in Bugzilla.


I've enabled access to the bug report now. It was still hidden because it was a security releated bug, but it should have been made visible after fixing it. You should be able to review the discussion on the bug now.

Regards,
Markus
Re: RAP and Cross Site Request Forgery attacks [message #1485568 is a reply to message #1482138] Mon, 24 November 2014 05:50 Go to previous message
Eclipse UserFriend
Markus,

Thank's for sharing the bug report.

From what I understand from the bug report RAP only checks in REST services if Content-Type is set to application/json. No Synchronization Token has been implemented.

Is this true both for 2.1 and for 2.2 release? Any plans regarding the token for the 3.0 release?

Regards,
luke
Previous Topic:Custom Widget with Session Timeout
Next Topic:Client error with Browser.execute function
Goto Forum:
  


Current Time: Sun Aug 31 10:23:06 EDT 2025

Powered by FUDForum. Page generated in 0.03591 seconds
.:: Contact :: Home ::.

Powered by: FUDforum 3.0.2.
Copyright ©2001-2010 FUDforum Bulletin Board Software

Back to the top

Sign up to our Newsletter

A fresh new issue delivered monthly