Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated documentation - Open Issue #272

Merged
merged 3 commits into from
Aug 16, 2024
Merged

Updated documentation - Open Issue #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c1f1159
Updated documentation - Open Issue
swetak20 May 22, 2024
0334d6f
Migrated and updated mardown file
swetak20 Jun 1, 2024
aeabd33
doc: various changes to the documentation
forgedhallpass Aug 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file removed assets/images/credentials_included.png
View file
Open in desktop
Binary file not shown.
0 assets/images/csrfguard_3.1.0.png → assets/images/csrfguard.png
View file
Open in desktop
File renamed without changes
1 change: 0 additions & 1 deletion csrfguard-test/csrfguard-test-jsp/src/main/webapp/WEB-INF/classes/Owasp.CsrfGuard.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,6 @@ org.owasp.csrfguard.Config.Print = true

##################################################################
## Javascript servlet settings if not set in web.xml ##
## https://wiki.owasp.org/index.php/CSRFGuard_3_Token_Injection ##
##################################################################

# This property denotes the location of the JavaScript template file that should be consumed and dynamically
Expand Down
2 changes: 1 addition & 1 deletion csrfguard/src/main/resources/csrfguard.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,7 +327,7 @@ org.owasp.csrfguard.Config.Print = true

##################################################################
## Javascript servlet settings if not set in web.xml ##
## https://wiki.owasp.org/index.php/CSRFGuard_3_Token_Injection ##
## https://owasp.org/www-project-csrfguard ##
##################################################################

# This property denotes the location of the JavaScript template file that should be consumed and dynamically
Expand Down
183 changes: 178 additions & 5 deletions index.md
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions info.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,8 @@ If you have questions, would like to share or discuss ideas, please use the offi

## CSRFGuard 4.0 Release Notes:

* [Support for stateless web applications](https://github.com/aramrami/OWASP-CSRFGuard/issues/122)
* [Apply "TokenPerPage" approach to AJAX](https://github.com/aramrami/OWASP-CSRFGuard/issues/123)
* [Support for stateless web applications](https://github.com/OWASP/www-project-csrfguard/issues/4)
* [Apply "TokenPerPage" approach to AJAX](https://github.com/OWASP/www-project-csrfguard/issues/2)
* [Reduced code duplication](https://github.com/aramrami/OWASP-CSRFGuard/issues/127)
* [Proper multi-module maven project structure](https://github.com/aramrami/OWASP-CSRFGuard/issues/128)
* [The test JSP web application now relies on the latest development JavaScript code](https://github.com/aramrami/OWASP-CSRFGuard/issues/133)
Expand Down
28 changes: 1 addition & 27 deletions readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,30 +175,4 @@ git push origin <tag_name>
You can download pre-compiled versions from:

* [Maven Central repository](https://search.maven.org/search?q=csrfguard)
* [OSS Sonatype Nexus repository](https://oss.sonatype.org/#nexus-search;gav~~csrfguard~~~)

## CSRFGuard 4.0.0 Release Notes

* [Support for stateless web applications](https://github.com/aramrami/OWASP-CSRFGuard/issues/122)
* [Apply "TokenPerPage" approach to AJAX](https://github.com/aramrami/OWASP-CSRFGuard/issues/123)
* [Reduced code duplication](https://github.com/aramrami/OWASP-CSRFGuard/issues/127)
* [Proper multi-module maven project structure](https://github.com/aramrami/OWASP-CSRFGuard/issues/128)
* [The test JSP web application now relies on the latest development JavaScript code](https://github.com/aramrami/OWASP-CSRFGuard/issues/133)
* [Improved code quality](https://github.com/aramrami/OWASP-CSRFGuard/issues/134)
* [Addressing synchronous XMLHttpRequest deprecation](https://github.com/aramrami/OWASP-CSRFGuard/issues/137)
* [Approach changed for master and page token retrieval](https://github.com/aramrami/OWASP-CSRFGuard/issues/139)
* [Improved test coverage](https://github.com/aramrami/OWASP-CSRFGuard/issues/140)
* [Better solution for looking up page tokens in the JS](https://github.com/aramrami/OWASP-CSRFGuard/issues/141)
* [The javascript template is now parsable and minifiable](https://github.com/aramrami/OWASP-CSRFGuard/issues/142)
* [Short-circuit the solution logic if CSRFGuard is disabled](https://github.com/aramrami/OWASP-CSRFGuard/issues/143)
* [Do not generate page tokens for pages that are not protected](https://github.com/aramrami/OWASP-CSRFGuard/issues/144)
* [Page tokens generated on first use are not sent back to the client](https://github.com/aramrami/OWASP-CSRFGuard/issues/145)
* [Issue with the token-per-page support for REST endpoint containing path parameters](https://github.com/aramrami/OWASP-CSRFGuard/issues/146)
* [Possible race condition on first access of endpoints when token-per-page and AJAX request options are enabled](https://github.com/aramrami/OWASP-CSRFGuard/issues/147)
* [Tokens are not injected into dynamically created DOM elements ](https://github.com/aramrami/OWASP-CSRFGuard/issues/148)
* [Make the configuration more resilient to errors](https://github.com/aramrami/OWASP-CSRFGuard/issues/149)
* [Tokens should not be injected into external links if the domainStrict property is set to true](https://github.com/aramrami/OWASP-CSRFGuard/issues/150)
* [Tokens not injected in dynamic content returned from Ajax](https://github.com/aramrami/OWASP-CSRFGuard/issues/151)
* Heavily refactored, improved and more optimized code-base
* Documentation update and typo fixes.
* Copyright update and unification.
* [OSS Sonatype Nexus repository](https://oss.sonatype.org/#nexus-search;gav~~csrfguard~~~)
29 changes: 2 additions & 27 deletions tab_features.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,34 +9,9 @@ tags: csrfguard
---
# OWASP CSRFGuard 4.0.0

![OWASP CSRFGuard 4.0.0](assets/images/csrfguard_3.1.0.png)
![OWASP CSRFGuard 4.0.0](assets/images/csrfguard.png)

# Some CSRGuard features

## Tags
```
<img src=“https://bank.com/fn?param=1”>
<iframe src=“https://bank.com/fn?param=1”>
<script src=“https://bank.com/fn?param=1”>
```

## Autoposting Forms
```
<body onload="document.forms[0].submit()">
<form method="POST" action=“https://bank.com/fn”>
<input type="hidden" name="sp" value="8109"/>
</form>
```
## XmlHttpRequest
Subject to same origin policy

## Credentials Included

![Credentials Included](assets/images/credentials_included.png)

# How Does CSRF Work?

## What is CSRF (Cross-Site Request Forgery) Attacks
## What are CSRF (Cross-Site Request Forgery) Attacks?

![How Does CSRF Work](assets/images/what_is_csrf_attacks_1.png)
![How Does CSRF Work](assets/images/what_is_csrf_attacks_2.png)
Expand Down
15 changes: 0 additions & 15 deletions tab_news.md
View file
Open in desktop

This file was deleted.

31 changes: 0 additions & 31 deletions tab_roadmap.md
View file
Open in desktop

This file was deleted.

Loading