You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Yesod supports CSRF protection when generating forms, but as far as I'm aware, doesn't have native support for validating CSRF tokens when making requests from Javascript requests.
To improve this situation, I'd like to:
Add the CSRF token to the scaffolding's default layout in a way that is accessible by Javascript, potentially in a <meta> tag in the <head> of the HTML (This is what Ruby on Rails does):
mCsrfToken <-fmap reqToken getRequest -- in defaultLayout function
Add a function to Yesod to check the CSRF token in a standard way for Javascript requests. I'm not sure if there's a better solution here than requiring users to manually call a checkCsrfToken method. Potentially it could be combined with functions like requireJsonBody?
I think these changes would improve security for Yesod users, who might not be aware of CSRF attacks, and improve Yesod as an API server. Thoughts?
Somewhat related: SO answer in which I implement some bits of this functionality.
Yesod supports CSRF protection when generating forms, but as far as I'm aware, doesn't have native support for validating CSRF tokens when making requests from Javascript requests.
To improve this situation, I'd like to:
Add the CSRF token to the scaffolding's default layout in a way that is accessible by Javascript, potentially in a
<meta>tag in the<head>of the HTML (This is what Ruby on Rails does):Add something to the scaffolding to add the CSRF token to a request made by Javascript (potentially using jQuery's
ajaxPrefilterto add the token as a header). This would go along with the PR to add more JSON examples to the scaffolding (Draft of using Yesod as an API server to a Javascript frontend yesod-scaffold#76)Add a function to Yesod to check the CSRF token in a standard way for Javascript requests. I'm not sure if there's a better solution here than requiring users to manually call a
checkCsrfTokenmethod. Potentially it could be combined with functions likerequireJsonBody?I think these changes would improve security for Yesod users, who might not be aware of CSRF attacks, and improve Yesod as an API server. Thoughts?
Somewhat related: SO answer in which I implement some bits of this functionality.