yesodweb/yesod — Issue #214: yesod-form nonces are not nonces
Author: meteficha
Created: 2012-01-11 18:33:30+00:00
State: open

Hey!

Currently `yesod-form` uses nonces to prevent CSRF (cross-site request forgeries). However, a nonce gets its name by being used only once. OTOH, `yesod-form`'s nonces are actually never changed for the whole session of a user, which could potentially have even years of duration should the user access the site regularly.

This reused nonce does protect against most CSRF attacks, since each session has its own and an attacker can't predict what's the nonce of a user's session. However, if by whatever means the attacker ever gets its hand on the user's nonce, it's game over for that user. I don't know whether or not this is really exploitable and/or was exploited before on other sites.

So, is this reusing nature of `yesod-form`'s nonces an intended feature, or an overlooked bug? If it's a feature, it shouldn't be called a nonce. If it's a bug, we should fix it =).

A drawback of using real nonces is that opening another tab with a form renders any other opened forms unusable. Users using only one tab are not affected, if I'm not mistaken.

Cheers!