NUBIC/aker-rails — Issue #4: aker-rails bypasses Rails' CSRF protection
Author: yipdw
Created: 2012-01-04 21:01:36+00:00
State: open
Labels: bug, Rails 2.3.x, Rails 3.x

When a CSRF attack is made on an application using aker-rails in Rails >= 3.0.4 or Rails >= 2.3.11, aker-rails will permit that attack to proceed. However, further CSRF attacks made on the same session will not proceed.

Reason: The aforementioned versions of Rails contain a fix for CVE-2011-0447, which changed the way requests without valid CSRF tokens are handled. Previously, an `ActionController::InvalidAuthenticityToken` exception was raised, which halted request processing; now, the request is marked as unverified and the session is cleared.

Because

1. request processing no longer halts,
2. Aker's authentication checks come before the CSRF token check, and
3. Aker-Rails checks values in the Rack environment, not the session

the first CSRF attack passes.