CSRF filter and same-origin requests

[andrew-nowak]

Hi! I have a question about the interaction between the CORS and CSRF filters.

It's documented that "if you have a CORS filter before your CSRF filter, the CSRF filter will let through CORS requests from trusted origins". https://www.playframework.com/documentation/3.0.x/JavaCsrf#Trusting-CORS-requests

I believe this happens when the request is tagged as trusted by the CORS filter and that tag is then discovered by the CSRF filter. However, I can see that tag isn't applied for same-origin requests, as the logic branch in the CORS filter doesn't apply the tag, meaning that same-origin requests need to .

Why does the CSRF filter not let through same-origin requests, especially if it has been configured to allow through cross-origin requests from trusted origins? Is it something that could be added, even if behind a configuration option? (I'd be happy to contribute this if it was acceptable)

[arnabnandy7]

@andrew-nowak Thanks for raising this. Your reading of the implementation is correct: the CORS filter deliberately passes same-origin requests through without adding CORSFilter.Attrs.Origin, so the CSRF filter does not apply the trusted-CORS bypass to them.

I would avoid tagging same-origin requests as CORS-trusted because that attribute specifically represents a cross-origin request accepted by the configured CORS policy. Changing its meaning could have unintended effects elsewhere.

A separate opt-in CSRF setting for bypassing requests with a validated same-origin Origin header could be reasonable, though. We would need to consider reverse proxies and forwarded headers carefully, and retain the current conservative behavior when the Origin header is absent, malformed, or null.

A contribution along those lines with tests covering scheme, host, effective port, proxy behavior, and disabled-by-default behavior should be proposed in issues.