diaspora/diaspora — Issue #2679: No CSRF protection on Diaspora
Author: joshholly
Created: 2012-01-17 01:28:19+00:00
State: open

I noticed that there are no CSRF token on Diaspora. This could be a major issue, almost as bad as XSS. Here is an example of how you can commit CSRF:

1. POST TO http://diasporapod.com/status_messages with the content:
{"status_message":{"text":"TEST TEST"},"aspect_ids":"public"}

This will cause the user to post the content "TEST TEST"

HOW TO FIX:
On every user action form (such as posting, adding to aspects, liking, commenting, etc), add a CSRF token to the form as a form field. Make the CSRF token unique to the user and encrypted. This should fix the issue.