Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of jorton@redhat.com designates
 66.187.233.31 as permitted sender)
Date: Tue, 11 Mar 2008 14:47:54 +0000
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: [PATCH] prevent CSRF in mod_proxy_balancer
Message-ID: <20080311144754.GA23708@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <20080311142317.GA28907@redhat.com>
 <99EA83DCDE961346AFA9B5EC33FEC08B66A926@VF-MBX11.internal.vodafone.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <99EA83DCDE961346AFA9B5EC33FEC08B66A926@VF-MBX11.internal.vodafone.com>
User-Agent: Mutt/1.5.17 (2007-11-01)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Tue, Mar 11, 2008 at 03:39:22PM +0100, Plüm, Rüdiger, VF-Group wrote:
> > It occurred to me recently that it is relatively simple to prevent 
> > "CSRF" attacks against the balancer-handler (see CVE-2007-6420), by 
> > generating a "secret" nonce at startup and requiring the presence of 
> > that secret in the submitted parameters.
> > 
> > Any objections?
> 
> Just that I understand this correctly: The GET requests that actually do
> some configuration changes via the balancer manager become invalid as
> soon as httpd is restarted (gracefull restart is not sufficient, correct?).
> As long as httpd keeps running the GET requests remain valid and can be
> reused.

Correct.  If you submit a form making some balancer config changes, and 
httpd has been through a full stop/start since the form was loaded into 
the browser, the changes will be ignored.

(You could perhaps argue that this is a good thing anyway, since the 
balancer config may have changed completely in the restart?)

joe