🏆Capstone project: Close the Cross-Origin Holes

Nine findings are closed. The two red tests that remain are about requests that a page on another site causes, and for those you have a tool: the model browser you wrote in Chapters 8 and 9. The contract says that one of its rules was weakened. So the tool comes first.

The reason is the direction of the mistake. A model that is wrong in the strict direction would refuse requests a browser sends, and you would notice at once, because the service’s own page would stop working. A model that is wrong in the generous direction is quieter. It shows attacks arriving that a real browser would have stopped, and it sends you after defenses for requests that cannot happen, while telling you nothing true about the ones that can.

Find the rule

The model has its own tests. Run them:

python -m pytest tests/test_browser.py -q

Four of the six fail, and the summary at the end names them:

• test_lax_cookie_stays_home_on_a_cross_site_post

• test_samesite_stops_a_form_from_another_site

• test_a_page_without_permission_cannot_read

• test_a_delete_is_asked_about_first

The last two are your Chapter 9 tests, and they fail on the server’s answer, not on the model: https://other.example is told that it may read GET /about and send a DELETE. That is finding 11, and it waits until the end of this lesson. The first two are about the model.

Read the first one. It builds one SameSite=Lax cookie, asks mini_browser.cookies_to_send() what goes with a top-level POST from https://other.example, and expects nothing. It gets the cookie. The second test is the same mistake seen through visit.visit(): a form on another site arrives with Ana’s session cookie.

cookies_to_send() asks one function about SameSite, and that is where to look. The rule from Chapter 8: a Lax cookie goes with a cross-site request only when the request is top-level and its method is GET or HEAD. A link someone follows carries it. A form that posts does not.

Repair the rule and run the six tests again before you go on. The two model tests pass; the two Chapter 9 tests still fail until finding 11 is closed. Be careful not to overshoot: a Lax cookie still goes with a POST from the same site, and with a link followed from another site.

Finding 10

“The delete form is accepted with a form token that was issued to a different session.”

Think about who can use that. The neighbor at https://notes.reading.example is on the same site as the reading list, so a form on their page arrives with Ana’s cookie. The neighbor cannot read Ana’s form token. But the neighbor can have an account of their own, log in, and read the token in their own page. If the server accepts any token it ever issued, the neighbor’s page sends its own token with Ana’s cookie, and the token check passes.

Your test for this finding shows it: Ana’s cookie, Ben’s token, a trusted Origin, and the book is gone. The check in delete_from_form() asks whether the token is known. The question it must ask is whether the token belongs to the session the cookie names. csrf_matches(session, sent) answers exactly that for one session, with hmac.compare_digest, and the function already has that session in its hand.

You might object that the neighbor’s form is stopped anyway. Its Origin is https://notes.reading.example, and the Origin check refuses it before the token is looked at. That is true today.

In Chapter 8 you wrote one test with the Origin check out of the way and one with the token out of the way, to prove that either defense stops the neighbor alone. Finding 10 is the case where the token, alone, stops nobody who has an account.

Finding 11

“A page on any origin is told that it may read the service’s answers.”

Your test sends GET /about with Origin: https://other.example and finds that origin repeated in access-control-allow-origin. Chapter 9 called this reflection. It looks more careful than *, because the header names one origin. It is worse: a browser refuses to combine * with credentials, and it has no such objection to a reflected origin. So on GET /me, where the service allows credentials, a page whose requests carry Ana’s cookie could read her name. With SameSite=Lax that is the neighbor at https://notes.reading.example. A page on another site sends no cookie and reads an answer with no user in it. POST /tokens allows credentials too, and there only the Origin check stands between the neighbor and a token made with her cookie.

The repair is in cors_headers(). The permission goes only to an origin that is in trusted, compared whole. That set is state["trusted_origins"], the same one the Origin check uses, so the two decisions cannot drift apart. Keep vary: Origin on every answer, also on a refusal: the answer depends on that header either way.

Your task

Three changes, in this order: the rule in mini_browser.py, the token check in the form’s branch, and the condition in cors_headers(). Then run everything:

python -m pytest -q

The result to expect is zero failures: eleven attack tests and six model tests.

Then press Check my work. It calls your model’s functions with cookies and sites you have not seen, and runs tests/test_browser.py against it. It checks finding 10 with two sessions of its own and finding 11 with a trusted set of its own, where an origin that only starts like a trusted one must be refused. Then it runs the contract’s sequence of requests in memory twice: your server with a correct model, and a correct server with your model, so that a mistake on one side cannot hide behind the other. That model is a model too; it is not a browser. Last, everything from Lesson 2 is checked again.

Nothing has touched a socket yet. The next lesson runs the whole service on the loopback address.