Complete CSRF cleanup for Teleport 18 #50534
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a partial revert of #50358. We need to keep the CSRF token in the SSO flows for now, as it is used to ensure that the flow is completed by the same actor who initiated the sign-on.
This package is only used to protect against login CSRF with SSO flows. Teleport's web API is protected from CSRF by nature of using a bearer token, and does not require this package. This particular pacakge is only necessary for SSO because the user is not yet logged in when the SSO flow begins, so they don't have a bearer token.
Additionally expand upon the godocs for our various middlewares so that it's clear which ones provide CSRF protection.
zmb3
added
the
no-changelog
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is the last OSS PR planned to simplify our CSRF package going forward.
Best to review commit-by-commit.
SSO flows are the one case where we need to rely on a cookie with a CSRF token because
a bearer token is not available to users prior to authenticating.
focused solely on protecting against login CSRF.
and expands our godocs in a few important areas.