basho/riak_control — pull request #28 by cmeiklejohn (2012-07-12 07:22:24+00:00)
Title: Add CSRF token prevention.

Add CSRF token prevention to Riak Control.

* Break out resources which perform potentially destructive actions.
* Switch these from GET requests to POST requests.
* No longer serve index.html off of the file system, serve from erlydtl template so we can insert a CSRF token into the header as a meta tag. (Potentially problematic because users might have bookmarked /admin/ui/index.html).

The changes to the API are less than awesome, but are good enough to get us to a place where things feel much safter (POST vs non-idempotent GET).

To note:

I haven't been able to fully perform an end-to-end test of this yet, because there appears to be a problem with erlydtl being initialized correctly. During render the following happens:

```erlang
{error,undef,
[{erlydtl_runtime,find_value, ...
```

Any thoughts?

@reiddraper @dizzyd