Rails 4.0 + Rails 4.1 CSRF problems affecting IE 11, Edge, newer versions of Android and mobile Safari

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Rails 4.0 + Rails 4.1 CSRF problems affecting IE 11, Edge, newer versions of Android and mobile Safari

Jason Fleetwood-Boldt
Rails community,

I have been investigating and debugging a serious, widespread problems with our Rails 4.1 app (I realize Rails 4.1 is no longer supported, see below.)

This is not a simple "pass the CSFR token from the form to the controller" question. 

This appears to me to be a serious, widespread architectural flaw in Rails 4.0 and Rails 4.1 that appear to basically make those versions of Rails essentially incompatible with newer browsers. (The newer browsers, by the way, appear not to be respecting Cache-control headers, which looks to me the like the root of the problem)

The problem is detailed here:

https://stackoverflow.com/questions/45329731/csrf-tokens-to-not-match-what-is-in-session-rails-4-1?noredirect=1#comment77622671_45329731


Quick question: 

As explained here, I understand that the CSRF implementation to be different in Rails 5. Specifically, each form gets its own token. My question is this: Does this new design in Rails 5 eliminate or lessen the symptom described in my SO post above?

If so, this would be a compelling reason for us to upgrade to Rails 5, as we think we are loosing a significant amount of traffic due to this bug. 

If not, I am wondering if others are seeing this too and what can be done to address this issue. 

-Jason




----

Jason Fleetwood-Boldt
http://www.jasonfleetwoodboldt.com/writing

If you'd like to reply by encrypted email you can find my public key on jasonfleetwoodboldt.com (more about setting GPG: https://gpgtools.org) 

--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/rubyonrails-core.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Rails 4.0 + Rails 4.1 CSRF problems affecting IE 11, Edge, newer versions of Android and mobile Safari

Jason Fleetwood-Boldt
Incidentally, shortly after I wrote this I think I came across a lead as to what our problem is. 

Nonetheless, I am still interested in hearing from community if this affects others and how people went about debugging/fixing it. 

following up on the SO post actually is slightly easier than processing email chains, so if anyone has anything to add to the SO post please feel free to post it there. 

-Jason


On Aug 7, 2017, at 1:35 PM, Jason Fleetwood-Boldt <[hidden email]> wrote:

Rails community,

I have been investigating and debugging a serious, widespread problems with our Rails 4.1 app (I realize Rails 4.1 is no longer supported, see below.)

This is not a simple "pass the CSFR token from the form to the controller" question. 

This appears to me to be a serious, widespread architectural flaw in Rails 4.0 and Rails 4.1 that appear to basically make those versions of Rails essentially incompatible with newer browsers. (The newer browsers, by the way, appear not to be respecting Cache-control headers, which looks to me the like the root of the problem)

The problem is detailed here:

https://stackoverflow.com/questions/45329731/csrf-tokens-to-not-match-what-is-in-session-rails-4-1?noredirect=1#comment77622671_45329731


Quick question: 

As explained here, I understand that the CSRF implementation to be different in Rails 5. Specifically, each form gets its own token. My question is this: Does this new design in Rails 5 eliminate or lessen the symptom described in my SO post above?

If so, this would be a compelling reason for us to upgrade to Rails 5, as we think we are loosing a significant amount of traffic due to this bug. 

If not, I am wondering if others are seeing this too and what can be done to address this issue. 

-Jason




If you'd like to reply by encrypted email you can find my public key on jasonfleetwoodboldt.com (more about setting GPG: https://gpgtools.org


--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/rubyonrails-core.
For more options, visit https://groups.google.com/d/optout.

If you'd like to reply by encrypted email you can find my public key on jasonfleetwoodboldt.com (more about setting GPG: https://gpgtools.org

--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/rubyonrails-core.
For more options, visit https://groups.google.com/d/optout.
Loading...