galaxyproject / galaxyproject/galaxy
More CSRF Protection
- Dominant language
- Python
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 3d 51m
- Merged PRs (30d)
- 148
Description
https://github.com/galaxyproject/galaxy/pull/4365 implements basic CSRF support for login, logout, and user registration. We should extend that:
Other forms - high priority:
- [ ] Tool shed installation.
- [ ] User / Group / Role creation / deletion / modification.
- [ ] Password change.
Other forms - medium priority:
- [ ] Tool execution, workflow submission
- [ ] ...
Other tasks:
- [ ] Convert logout to a POST so we can restrict CSRF protection to POST requests (it is also the right thing to do RESTfully). xref https://github.com/galaxyproject/galaxy/pull/4365#issuecomment-319636861
- [ ] Implement tests to be sure it is working and to be sure it doesn't regress when switching away from mako for these initial forms.
Contributor guide
Assessment
This issue has not been assessed yet.