Odoo Changelog — 2020-08-09

Sunday, August 9, 2020

1 change · master

Improvements(1)

Enhancements to existing features

[IMP] http, *: remove default CSRF tokens expiration

CoremastersurveyhttpMedium

Forms and login pages will no longer fail just because a user paused for more than an hour before submitting. Security remains tied to the user session, so tokens still expire when the session ends, while survey-related tests were corrected to match the updated behavior.

Original PR description

Our CSRF tokens are based on the current user session, and automatically expire as soon as the session does.

However, they also come with a default 1h expiration delay. This proves to be a frequent annoyance for users who pause more than 1h on a form before submitting it (e.g. user logs out and browser sits on login page until the next day).
It can even lead to blocking bugs, e.g. when the 1h expiration occurs in the middle of taking a survey exam, and the user is never able to post the answers that are only present in the state of the form they need to post.

More generally, users have a hard time understanding those CSRF expiration errors, and don't know how to react.

Longer default expiration times have been considered (e.g. 1 day or 1 week) but those would not bring any identified benefit in terms of security, while still giving a chance that some users would experience the incomprehensible HTTP 400 errors).

Attacks that can typically compromise the CSRF token (XSS, RCE) can achieve as much, or more, on the system or user account than what is possible with the token. And nothing generally prevents the attacker from using the token immediately after capturing it, during the initial attack, making the expiration delay rather irrelevant.

Given there seems to be no significant benefit in expiring the tokens before the session itself, let's just keep them valid as long as the session.

Note: sessions are GC'd automatically after 7 days of inactivity, which gives an effective 1 week expiry for abandoned web forms anyway, as the token expires with the session. But at least we won't bother otherwise active users.

Additionally, fix `survey` module tests, that were using an incorrect regex for extracting CSRF tokens.

#csrf#forms#sessions#surveys

Our CSRF tokens are based on the current user session, and automatically expire as soon as the session does. However, they also come with a default 1h expiration delay. This proves to be a frequent annoyance for users who pause more than 1h on a form before submitting it (e.g. user logs out and browser sits on login page until the next day). It can even lead to blocking bugs, e.g. when the 1h expiration occurs in the middle of taking a survey exam, and the user is never able to post the answers that are only present in the state of the form they need to post. More generally, users have a hard time understanding those CSRF expiration errors, and don't know how to react. Longer default expiration times have been considered (e.g. 1 day or 1 week) but those would not bring any identified benefit in terms of security, while still giving a chance that some users would experience the incomprehensible HTTP 400 errors). Attacks that can typically compromise the CSRF token (XSS, RCE) can achieve as much, or more, on the system or user account than what is possible with the token. And nothing generally prevents the attacker from using the token immediately after capturing it, during the initial attack, making the expiration delay rather irrelevant. Given there seems to be no significant benefit in expiring the tokens before the session itself, let's just keep them valid as long as the session. Note: sessions are GC'd automatically after 7 days of inactivity, which gives an effective 1 week expiry for abandoned web forms anyway, as the token expires with the session. But at least we won't bother otherwise active users. Additionally, fix `survey` module tests, that were using an incorrect regex for extracting CSRF tokens.