Only check OCS-APIREQUEST header in case of an apptoken
Open
Nobody has claimed this yet.
1. to develop
enhancement
feature: authentication
security
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
We should only check the OCS-APIREQUEST header in case of an apptoken. Otherwise we should always require the presence of a CSRF token. (in the past there have been bugs that would allow an attacker to set arbitrary headers potentially cross-origin)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing where the OCS-APIREQUEST header, app tokens, and CSRF tokens are handled in the server. Verify the intended exception for app-token requests and the requirement for CSRF tokens in other cases, using the linked HackerOne report as security context. Done means the behavior is covered by regression tests and the cross-origin header case is no longer accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100