name: XSRF filtering

sort: 4

Cross-Site Request Forgery

XSRF, Cross-Site Request Forgery, is an important security concern for web development. Beego has built in XSRF protection which assigns each user a randomized cookie that is used to verify requests. XSRF protection can be activated by setting EnableXSRF = true in the configuration file:

  1. EnableXSRF = true
  2. XSRFKey = 61oETzKXQAGaYdkL5gEmGeJJFuYh7EQnp2XdTP1o
  3. XSRFExpire = 3600 // set cookie expire in 3600 seconds, default to 60 seconds if not specified

XSRF protection can also be enabled in the main application entry function:

  1. beego.BConfig.WebConfig.EnableXSRF = true
  2. beego.BConfig.WebConfig.XSRFKey = "61oETzKXQAGaYdkL5gEmGeJJFuYh7EQnp2XdTP1o"
  3. beego.BConfig.WebConfig.XSRFExpire = 3600

When XSRF is enabled Beego will set a cookie _xsrf for every user. Beego will refuse any POST, PUT, or DELETE request that does not include this cookie. If XSRF protection is enabled a field must be added to provide an _xsrf value to every form. This can be added directly in the template with XSRFFormHTML().

A global expiration time should be set using beego.XSRFExpire. This value can be also be set for individual logic functions:

  1. func (this *HomeController) Get(){
  2.     this.XSRFExpire = 7200
  3.     this.Data["xsrfdata"]=template.HTML(this.XSRFFormHTML())
  4. }

Usage in form

Set data in controller:

  1. func (this *HomeController) Get(){
  2.     this.Data["xsrfdata"]=template.HTML(this.XSRFFormHTML())
  3. }

Then use it in template:

  1. <form action="/new_message" method="post">
  2.   {{ .xsrfdata }}
  3.   <input type="text" name="message"/>
  4.   <input type="submit" value="Post"/>
  5. </form>

Usage in javascript

If AJAX is being used to POST a request, _xsrf should be added using javascript. The example below uses jQuery to add _xsrf to every request automatically.

jQuery cookie plugin: https://github.com/carhartl/jquery-cookie base64 plugin: http://phpjs.org/functions/base64_decode/

  1. jQuery.postJSON = function(url, args, callback) {
  2.    var xsrf, xsrflist;
  3.    xsrf = $.cookie("_xsrf");
  4.    xsrflist = xsrf.split("|");
  5.    args._xsrf = base64_decode(xsrflist[0]);
  6.     $.ajax({url: url, data: $.param(args), dataType: "text", type: "POST",
  7.         success: function(response) {
  8.         callback(eval("(" + response + ")"));
  9.     }});
  10. };

Extending jQuery

Add xsrf to every request header by extending AJAX.

Save the _xsrf value in html:

  1. func (this *HomeController) Get(){
  2.     this.Data["xsrf_token"] = this.XSRFToken()
  3. }

Put it into the head:

  1. <head>
  2.     <meta name="_xsrf" content="{{.xsrf_token}}" />
  3. </head>

Extending Ajax by adding _xsrf into header also supports jQuery methods which use AJAX internally, such as POST and GET.

  1. var ajax = $.ajax;
  2. $.extend({
  3.     ajax: function(url, options) {
  4.         if (typeof url === 'object') {
  5.             options = url;
  6.             url = undefined;
  7.         }
  8.         options = options || {};
  9.         url = options.url;
  10.         var xsrftoken = $('meta[name=_xsrf]').attr('content');
  11.         var headers = options.headers || {};
  12.         var domain = document.domain.replace(/\./ig, '\\.');
  13.         if (!/^(http:|https:).*/.test(url) || eval('/^(http:|https:)\\/\\/(.+\\.)*' + domain + '.*/').test(url)) {
  14.             headers = $.extend(headers, {'X-Xsrftoken':xsrftoken});
  15.         }
  16.         options.headers = headers;
  17.         return ajax(url, options);
  18.     }
  19. });

For PUT, POST, and DELETE requests which don’t use form content as parameters, pass XSRF tokens by X-XSRFToken in the HTTP header.

To customize XSRF behavior for different requests, overwrite the CheckXSRFCookie method of the Controller. To support an API which doesn’t support XSRF, disable XSRF protection by setting CheckXSRFCookie() to empty. XSRF protection should be used to accommodate cookie validated requests with and without cookie support at the same time.

support controller setting

XSRF is a global variable. If it is set it to true, then every request will be validated. If the APIs don’t need to be validated, then set XSRF to false in controllers:

  1. type AdminController struct{
  2.     beego.Controller
  3. }
  5. func (a *AdminController) Prepare() {
  6.     a.EnableXSRF = false
  7. }