OWASP / OWASP/SecurityShepherd
Make CSRF Challenge 5+ Descriptions Better
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
First time students get mixed up between Shepherds platform token and the tokens they need to retrieve.
When the user is given their CSRF token it also needs to be more clear. eg:
CSRF Token not found in session. CSRF Token Set to 4<br><br>Please try again
Some students think the CSRF Token pattern is '4
' rather than '4'
So the Level Descriptions need to be updated to be more clear on how to find the CSRF Token for the challenge and the CSRF Token messages need to include quotes
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Locate the CSRF Challenge 5+ level descriptions and the CSRF token message text, then clarify how students find the challenge token and quote the token value so HTML breaks are not mistaken for part of it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100