playframework/playframework — pull request #3177 by serphacker (2014-07-15 10:04:00+00:00)
Title: Add option to disable CSRF Header Bypass

Play Framework won't check if the CSRF Token is valid if :
_ header X-Requested-With is defined
_ header Csrf-Token has value "nocheck"

These protection are considered valid because it's theorically impossible to inject custom Header without Javascript (which restrict to same domain). However These protections have been proven insecure under a combination of browser plugins and redirects which can allow an attacker to provide custom HTTP headers on a request to any website. It was a vulnerability in a Flash plugin, now fixed (~late 2013 I think), but others browser extensions (or even browser themselves) maybe vulnerable.

Due to this issue, Ruby on Rails dropped the csrf header validation on 2.0, Django after 1.2.5.

Disabling csrf header bypass would not be backward compatible and could break some application relying on X-Requested-With header (I think Csrf-Token is only used for debugging purpose).

What I suggest is adding an option "csrf.AllowBypass" defaulted to true, keeping the current behavior of CSRF Validation. If set to false, header bypass would be disabled, only a valid csrf token could validate the response. This would allow a slighty higher security level.