Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

oauth example doesn't validate CSRF token #2511

Open
davidpdrsn opened this issue Jan 13, 2024 · 3 comments · Fixed by #2512
Open

oauth example doesn't validate CSRF token #2511

davidpdrsn opened this issue Jan 13, 2024 · 3 comments · Fixed by #2512
Assignees
@loganbnielsen
Labels
E-help-wanted Call for participation: Help is requested to fix this issue. E-medium Call for participation: Experience needed to fix: Medium / intermediate

Comments

@davidpdrsn
Copy link
Member

davidpdrsn commented Jan 13, 2024 •
edited

The CSRF token generated here needs to be validated for login attemps. The oauth example currently doesn't do that.

Thank you to Nicolas Ettlin for reporting this issue
@davidpdrsn davidpdrsn added E-help-wanted Call for participation: Help is requested to fix this issue. E-medium Call for participation: Experience needed to fix: Medium / intermediate labels Jan 13, 2024
@davidpdrsn davidpdrsn mentioned this issue Jan 13, 2024
Merged
@jplatte jplatte reopened this Jan 13, 2024
@loganbnielsen
Copy link

I can give this a go if that's alright

@davidpdrsn
Copy link
Member Author

@loganbnielsen thank you!

@loganbnielsen loganbnielsen mentioned this issue Jan 25, 2024
Open
@loganbnielsen
Copy link

Made PR #2534

@yinho999 yinho999 mentioned this issue Feb 8, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@loganbnielsen loganbnielsen

Labels
E-help-wanted Call for participation: Help is requested to fix this issue. E-medium Call for participation: Experience needed to fix: Medium / intermediate
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add note about missing CSRF validation in oauth example tokio-rs/axum
3 participants
@davidpdrsn @jplatte @loganbnielsen