CSRFGuard 2.0 Installation - Revision history

Magne Land: /* Update Deployment Descriptor */

2009-08-24T21:16:27Z

‎Update Deployment Descriptor

Esheridan: CSRFGuard 2.x Installation moved to CSRFGuard 2.0 Installation: The 2.2 installation is slightly different

2008-04-05T17:04:05Z

CSRFGuard 2.x Installation moved to CSRFGuard 2.0 Installation: The 2.2 installation is slightly different

Esheridan: /* Update CSRFGuard Properties File */

2007-11-06T01:24:12Z

‎Update CSRFGuard Properties File

Esheridan: /* Update CSRFGuard Properties File */

2007-11-06T01:22:06Z

‎Update CSRFGuard Properties File

Esheridan at 01:19, 6 November 2007

2007-11-06T01:19:44Z

Esheridan at 01:07, 6 November 2007

2007-11-06T01:07:06Z

Esheridan at 14:04, 22 October 2007

2007-10-22T14:04:02Z

Esheridan at 21:42, 20 October 2007

2007-10-20T21:42:29Z

Esheridan at 21:41, 20 October 2007

2007-10-20T21:41:07Z

Esheridan at 21:23, 20 October 2007

2007-10-20T21:23:22Z

@@ Line 87: / Line 87: @@
   <filter>
     <filter-name>CSRFGuard</filter-name>
-    <filter-class>org.owasp.csrf.CSRFGuard</filter-class>
+    <filter-class>org.owasp.csrfguard.CSRFGuardFilter</filter-class>
       <init-param>
         <param-name>config</param-name>

@@ Line 76: / Line 76: @@
 :#org.owasp.csrfguard.actions.Redirect
 ::#The 'Redirect' action accepts one parameter called 'ErrorPage'.
 == Update Deployment Descriptor ==

@@ Line 30: / Line 30: @@
   org.owasp.csrfguard.handlers.HTMLParserHandler
-This ResponseHandler utilizes the open-source htmlparser (http://htmlparser.sourceforge.net) to manipulate the HTML response. The HTMLParserHandler is very accurate, relatively fast, easy to use/develop with, and offers a solid foundation for future enhancements. For example, future versions of CSRFGuard may parse custom JavaScript and insert the token in various (ex. window.location='') locations. Such robust enhancements to CSRFGuard cannot be achieved in a clean and easy-to-maintain manner in the other response handlers. However, the htmlparser has interesting side effects with HTML that is not well formed. The htmlparser will sometimes modify HTML that is not well-formed in an attempt to make it well-formed. As such, some of the HTML resulting from the handler may break functionality. One such example is the 'HttpOnly' lesson in WebGoat (written by some guy name Eric Sheridan). The HTML generated by this lesson is not well-formed (nested HTML forms) and the modifications made by the HTMLParserHandler actually break the functionality of the lesson. Specifically, the 'Yes No' radio buttons to not transmit all of the appropriate parameters.
+This ResponseHandler utilizes the open-source htmlparser (http://htmlparser.sourceforge.net) to manipulate the HTML response. The HTMLParserHandler is very accurate, relatively fast, easy to use/develop with, and offers a solid foundation for future enhancements. For example, future versions of CSRFGuard may parse custom JavaScript and insert the token in various (ex. window.location) locations. Such robust enhancements to CSRFGuard cannot be achieved in a clean and easy-to-maintain manner in the other response handlers. However, the htmlparser has interesting side effects with HTML that is not well formed. The htmlparser will sometimes modify HTML that is not well-formed in an attempt to make it well-formed. As such, some of the HTML resulting from the handler may break functionality. One such example is the 'HttpOnly' lesson in WebGoat (written by some guy name Eric Sheridan). The HTML generated by this lesson is not well-formed (nested HTML forms) and the modifications made by the HTMLParserHandler actually break the functionality of the lesson. Specifically, the 'Yes No' radio buttons to not transmit all of the appropriate parameters.
   org.owasp.csrfguard.handlers.RegExHandler
@@ Line 69: / Line 69: @@
 This directive says that 'for the action 'Redirect', we have a parameter called 'ErrorPage' with the value 'attack''.
 == Update Deployment Descriptor ==

← Older revision		Revision as of 01:19, 6 November 2007
Line 41:		Line 41:

	'''Note:''' It is vitally important to thoroughly test the ResponseHandler in your environment before deploying it to production. There is risk that the modification of your HTML might break existing functionality.		'''Note:''' It is vitally important to thoroughly test the ResponseHandler in your environment before deploying it to production. There is risk that the modification of your HTML might break existing functionality.
		+
		+	=== org.owasp.csrfguard.TokenName ===
		+
		+	This directive determines the name of the token placed in the HTML response. The default token name is 'OWASP_CSRFTOKEN'.
		+
		+	=== org.owasp.csrfguard.TokenLength ===
		+
		+	This directive determines the length of the unique request token. The default length is 32 characters.
		+
		+	=== org.owasp.csrfguard.PRNG ===
		+
		+	This property is used to specify what random number generator should be used to generate the random token. The default PRNG is 'SHA1PRNG'.
		+
		+	=== org.owasp.csrfguard.action.class.[name] ===
		+
		+	This directive gives the user the ability to specify actions that should be invoked when a CSRF attack is detected. Every action extends the org.owasp.csrfguard.actions.CSRFAction abstract class. You can specify as many or as little actions as you wish. The default action is org.owasp.csrfguard.actions.DefaultAction. For each action, you can also specify one or more parameters to be passed to the action before it is executed.
		+
		+	The syntax for adding an action to the properties file is a little confusing at first glance. To understand how to add an action, let us consider the 'Redirect' action. Assume that we extends the CSRFAction base class and implemented our own action that redirects the user to an error page that we specify in a parameter. First, we add the following line to csrfguard.properties:
		+
		+	'''syntax:''' org.owasp.csrfguard.action.class.[className]=[class]
		+	'''example:''' org.owasp.csrfguard.action.class.Redirect=org.owasp.csrfguard.actions.Redirect
		+
		+	This directive says 'we have an action called 'Redirect' and its class file is at org.owasp.csrfguard.actions.Redirect'. Next, we want to pass a parameter that tells the action where to redirect the user
		+
		+	'''syntax:''' org.owasp.csrfguard.action.class[className].param.[parameterName]=[parameterValue]
		+	'''example:''' org.owasp.csrfguard.action.class.Redirect.param.ErrorPage=attack
		+
		+	This directive says that 'for the action 'Redirect', we have a parameter called 'ErrorPage' with the value 'attack''.

	== Update Deployment Descriptor ==		== Update Deployment Descriptor ==

@@ Line 1: / Line 1: @@
 == Overview ==
-The second installment of the OWASP CSRFGuard utilizes an [http://htmlparser.sourceforge.net/ HTML Parser] for greater accuracy and usability. This page details all of the steps necessary to deploy CSRFGuard 2.x in your web application.
+The second installment of the OWASP CSRFGuard has been re-written from scratch to increase accuracy, efficiency, and overall usability. This page details all of the steps necessary to deploy CSRFGuard 2.x in your web application.
 '''Quick Steps:'''
-:# Copy ${PROJECT}/dist/OWASP-CSRFGuard-2.0.jar and ${PROJECT}/lib/htmlparser.jar to a directory accessible by your container.
+:# Copy OWASP CSRFGuard files to a directory accessible by your container
 :# Add a 'filter' entry to your web deployment descriptor.
 :# Add a mapping for the newly created filter entry.
-'''Note:''' If you map OWASP CSRFGuard to a resource that does not contain nor generate HTML (ex. images, Javascript source, etc.), you will get runtime exceptions!
+== Add OWASP CSRFGuard To ClassPath ==
-== Add OWASP CSRFGuard To ClassPath ==
+ org.owasp.csrfguard.handlers.RegExHandler
-In order for your web application container to invoke the OWASP CSRFGuard filter, it will need to be accessible in the classpath. If you are working with a single application, we recommend placing OWASP CSRFGuard and the htmlparser.jar dependency within the WEB-INF/lib folder of your web application project. If you have multiple projects (ex. an EAR) that make use of the filter, we recommend placing OWASP CSRFGuard and the htmlparser.jar dependency in a single library folder that is accessible by your container. For example, if our application container were Tomcat and we had multiple applications making use of OWASP CSRFGuard, we would place the Jar file in the tomcat/common/lib directory. OWASP CSRFGuard can now be utilized by every application deployed by the container.
+'''Note:''' It is vitally important to thoroughly test the ResponseHandler in your environment before deploying it to production. There is risk that the modification of your HTML might break existing functionality.
 == Update Deployment Descriptor ==
-Java EE filters provide the ability to intercept, view, and modify both the request and associated response for the requesting client. In order for our application to make use of the OWASP CSRFGuard filter, we must modify the application's web.xml file. First we must declare the filter and any initialization parameters that it may accept. Currently, the OWASP CSRFGuard 2.x series accepts 5 initialization parameters. These parameters are as follows:
+Java EE filters provide the ability to intercept, view, and modify both the request and associated response for the requesting client. In order for our application to make use of the OWASP CSRFGuard filter, we must modify the application's web.xml file. First we must declare the filter and the 'config' initialization parameter.
 The following is a sample entry used to test CSRFGuard in WebGoat:
@@ Line 31: / Line 52: @@
     <filter-class>org.owasp.csrf.CSRFGuard</filter-class>
       <init-param>
-        <param-name>error-page</param-name>
+        <param-name>config</param-name>
-       <param-value>attack</param-value>
+        <param-value>WEB-INF/csrfguard.properties</param-value>
       </init-param>
   </filter>
@@ Line 64: / Line 69: @@
   </filter-mapping>
-'''Note:''' If you map OWASP CSRFGuard to a resource that does not contain nor generate HTML (ex. images, Javascript source, etc.), you will get runtime exceptions!
+'''Note:''' If you map OWASP CSRFGuard to a resource that does not contain nor generate HTML (ex. images, Javascript source, etc.), you will may get runtime exceptions depending on the selected ResponseHandler!

← Older revision	Revision as of 17:04, 5 April 2008
(No difference)

← Older revision		Revision as of 21:23, 20 October 2007
Line 2:		Line 2:

	This page details all of the steps necessary to deploy CSRFGuard 2.x in your web application.		This page details all of the steps necessary to deploy CSRFGuard 2.x in your web application.
		+
		+	'''Quick Steps:'''
		+
		+	:# Copy OWASP-CSRFGuard-2.0.jar and htmlparser.jar to a directory accessible by your container.
		+	:# Add a 'filter' entry to your web deployment descriptor.
		+	:# Add a mapping for the newly created filter entry.

	== Add OWASP CSRFGuard To ClassPath ==		== Add OWASP CSRFGuard To ClassPath ==