Validate/Requiring an incoming crumb even if CORS origin does not match

[hapijs]

Validate/Requiring an incoming crumb even if CORS origin does not match

[stongo]

@briandela how is a CSRF going to occur on a CORS route from a non-matching origin? The request from a browser should never trigger the onPostAuth and onPreResponse handlers if it's not a matching allowed origin.

[briandela]

@stongo Completely forgot to respond to this. We were hoping to use crumb as a protection also against the curl scenario. Completely understand that CSRF/CORS is "browser" specific and in theory both CORS and CSRF should be enabled at the same time and that's the focus of crumb.

We completely understand that we are overloading crumb right now for something it wasn't intended to do (in addition to using it for standard CSRF).

Contrived example: we have multiple services that talk to each other. We use a crumb from one, to verify the call came from our system. We achieve this by using a shared iron encryption key across two services. If the payload matches the value in the encrypted cookie, we know that the crumb was generated by another part of system.

Again, this is not perfect as it just requires an automated call to one system to get a cookie for a replay against another but we have plenty of protections for that.

[lock]

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.