{"action":"created","issue":{"url":"https://api.github.com/repos/yesodweb/yesod/issues/905","labels_url":"https://api.github.com/repos/yesodweb/yesod/issues/905/labels{/name}","comments_url":"https://api.github.com/repos/yesodweb/yesod/issues/905/comments","events_url":"https://api.github.com/repos/yesodweb/yesod/issues/905/events","html_url":"https://github.com/yesodweb/yesod/issues/905","id":53952253,"number":905,"title":"A CSRF protection error occurs without reason when using Firefox","user":{"login":"YongJoonJoe","id":5916312,"avatar_url":"https://avatars.githubusercontent.com/u/5916312?v=3","gravatar_id":"","url":"https://api.github.com/users/YongJoonJoe","html_url":"https://github.com/YongJoonJoe","followers_url":"https://api.github.com/users/YongJoonJoe/followers","following_url":"https://api.github.com/users/YongJoonJoe/following{/other_user}","gists_url":"https://api.github.com/users/YongJoonJoe/gists{/gist_id}","starred_url":"https://api.github.com/users/YongJoonJoe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YongJoonJoe/subscriptions","organizations_url":"https://api.github.com/users/YongJoonJoe/orgs","repos_url":"https://api.github.com/users/YongJoonJoe/repos","events_url":"https://api.github.com/users/YongJoonJoe/events{/privacy}","received_events_url":"https://api.github.com/users/YongJoonJoe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-01-10T09:13:45Z","updated_at":"2015-01-11T06:02:07Z","closed_at":null,"body":"When I use `MForm Handler` to POST data, I encountered a CSRF protection error when using Firefox.\r\n\r\n\r\nI've tested the program in two Linux server those are have almost same configurations.\r\nThe differences between these two server are\r\n\r\n1. Remote server is VPS(virtual private server), and the other server is placed in local network (not client machine).\r\n1. `approot` is different. (of course)\r\n\r\nI've usually tested the program with Google Chrome only. \r\nWhen I tested the program with Firefox(tested in OS X, Windows. there are no add-ons installed), the program returns a CSRF protection error from remote server only. The other browsers (newest [Safari, Internet Explorer, Opera, etc.] with OS X and Windows) does not troubled with remote server.\r\nHowever, with local network server, the problem does not occur.\r\n\r\n1. With Firefox, the program returns a CSRF protection error from remote server only.\r\n1. With the other browser, the problem does not occurs.\r\n\r\nI couldn't understand how Yesod.Form detect (or prevent) CSRF attack, but I don't think this case is treated as a CSRF attack.\r\n\r\nQuestions:\r\n* Is this Yesod.Form problem?\r\n* Is this could be Firefox issue?\r\n* Is there needed more informations to define this problem?\r\n\r\nFrom the log, it shows nothing to remark\r\n```\r\n127.0.0.1 - - [10/Jan/2015:17:49:28 +0900] \"GET /refer HTTP/1.1\" 200 - \"http://yongjoon.net/AHStudy01/refer\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [10/Jan/2015:17:49:32 +0900] \"POST /refer HTTP/1.1\" 200 - \"http://yongjoon.net/AHStudy01/refer\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [10/Jan/2015:18:08:05 +0900] \"GET /refer HTTP/1.1\" 200 - \"\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [10/Jan/2015:18:08:08 +0900] \"POST /refer HTTP/1.1\" 200 - \"http://yongjoon.net/AHStudy01/refer\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n```\r\n\r\nOf course, \r\n1. those two program are same, (Also, I've tried copying a binary from local server to remote  server and tested.) \r\n1. produced HTML codes are same without `approot`\r\n1. and its server configurations are same.\r\n\r\nHere is the handler code.\r\n```\r\ngetReferMessageR :: Handler Html\r\ngetReferMessageR = do\r\n    (postSeparatedHashedMessageWidget, enctype) <- generateFormPost separatedHashedMessageForm\r\n    defaultLayout $ do\r\n        setTitle \"getReferMessageR\"\r\n        $(widgetFile \"header\")\r\n        $(widgetFile \"getReferMessage\")\r\n\r\npostReferMessageR :: Handler Html\r\npostReferMessageR = do\r\n    ((result,postSeparatedHashedMessageWidget),enctype) <- runFormPost separatedHashedMessageForm\r\n    case result of \r\n        FormSuccess referMessageSet -> do\r\n            let postedMD5Base64 = shmMD5Base64 referMessageSet\r\n            hsData <- runDB $ selectList [HashedSetHashMD5Base64 ==. postedMD5Base64] [Desc HashedSetTimeStamp]\r\n            defaultLayout $ do\r\n                setTitle \"postReferMessageR\"\r\n                $(widgetFile \"header\")\r\n                $(widgetFile \"postReferMessage\")\r\n        FormFailure [e] -> defaultLayout $ do\r\n                setTitle \"Fail when refering message : FormFailure\"\r\n                let errorMessage = Just $ toHtml e\r\n                $(widgetFile \"header\")\r\n                $(widgetFile \"hashedError\")\r\n        _ -> defaultLayout $ do\r\n                setTitle \"Fail when refering message : not FormSuccess anyway\"\r\n                let errorMessage = Just (T.pack \"anyway, not FormSuccess\")\r\n                $(widgetFile \"header\")\r\n                $(widgetFile \"hashedError\")\r\n```\r\n\r\nAnd here is the widget code\r\n```\r\n<form method=post action=@{ReferMessageR} enctype=#{enctype}>\r\n  <table>\r\n    ^{postSeparatedHashedMessageWidget}\r\n  <button>Refer\r\n```\r\n\r\nThe used libraries are\r\n* wai 3.0.2.1\r\n* wai-app-static 3.0.0.5\r\n* wai-extra 3.0.3.2\r\n* wai-logger 2.2.3\r\n* warp 3.0.5\r\n* yesod 1.4.1.3\r\n* yesod-auth 1.4.1.2\r\n* yesod-core 1.4.7.1\r\n* yesod-form 1.4.3.1\r\n* yesod-newsfeed 1.4.0.1\r\n* yesod-persistent 1.4.0.2\r\n* yesod-static 1.4.0.4"},"comment":{"url":"https://api.github.com/repos/yesodweb/yesod/issues/comments/69484817","html_url":"https://github.com/yesodweb/yesod/issues/905#issuecomment-69484817","issue_url":"https://api.github.com/repos/yesodweb/yesod/issues/905","id":69484817,"user":{"login":"YongJoonJoe","id":5916312,"avatar_url":"https://avatars.githubusercontent.com/u/5916312?v=3","gravatar_id":"","url":"https://api.github.com/users/YongJoonJoe","html_url":"https://github.com/YongJoonJoe","followers_url":"https://api.github.com/users/YongJoonJoe/followers","following_url":"https://api.github.com/users/YongJoonJoe/following{/other_user}","gists_url":"https://api.github.com/users/YongJoonJoe/gists{/gist_id}","starred_url":"https://api.github.com/users/YongJoonJoe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YongJoonJoe/subscriptions","organizations_url":"https://api.github.com/users/YongJoonJoe/orgs","repos_url":"https://api.github.com/users/YongJoonJoe/repos","events_url":"https://api.github.com/users/YongJoonJoe/events{/privacy}","received_events_url":"https://api.github.com/users/YongJoonJoe/received_events","type":"User","site_admin":false},"created_at":"2015-01-11T06:02:06Z","updated_at":"2015-01-11T06:02:06Z","body":"@paul-rouse  I'm sorry. I misunderstand your words. (<80ms) was response time.... Anyway I used shortcut, so I reload my page 5 times per seconds.\r\n\r\nI tested this case, and I finally could reproduce this problem on any machine.\r\n\r\nThe reason was that refreshing token.\r\n\r\nThe server runs two Yesod program. \r\n* http://MAINSITE : Personal site (NOT target site. Have no `token` element in HTML code)\r\n* http://MAINSITE/TESTSITE : Test site (TARGET site)\r\n(`approot' setting also follows each)\r\n\r\nThese two programs runs independently. \r\nHowever, __when I request something to Personal site, the token of Test site is refreshed__. So `Yesod.Form` judge this __old__ token from `POST` as CSRF.\r\n\r\n\r\nOf course, it usually does not happen. I reload the page in Test site for a times in very short time.\r\nAnd it seems to be that there are no visitor in Personal site.\r\nHowever, sometimes (I couldn't specify that situation), \r\nthe favicon (or something other) is requested not to Test site, but to Personal site when I make a request to Test site. (But this is not occur always. I couldn't define this situation. But it seems to be that Firefox request a favicon not always.)\r\nAccording to Personal site log, It shows that something like\r\n```\r\n127.0.0.1 - - [11/Jan/2015:13:42:01 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:01 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:01 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:01 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:01 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:11 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:11 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:17 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:17 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:17 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:34 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:34 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:35 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n127.0.0.1 - - [11/Jan/2015:13:42:35 +0900] \"GET /favicon.ico HTTP/1.1\" 200 1342 \"\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0\"\r\n```\r\n\r\nMy assumtion is as follow,\r\n\r\n1. I `GET` a page which have input form (\"_token\" = A) from Test site.\r\n1. Firefox request a favicon (or something other) from Personal site.\r\n1. Because of a request to Personal site, the token of Test site is refreshed. (Why?)\r\n1. I 'POST` data with 'old token', and Test site judge my data is not vaild one.\r\n\r\nI assume that I encountered problem with Firefox only because browsers' the request order is different each other.\r\n\r\nQuestion:\r\n\r\n1. What happens with Personal site and Test site's token? (may Yesod side's problem?)\r\n\r\nThese two programs are independent. Thier working directory is different.\r\nThe `approot` have a intersection(MAINSITE part), but different. \r\nBut why the token is refreshed when Personal site got request?\r\nThere could be something other reasons. However, when I make a request something(`GET`, `POST`, etc...) to Personal site, the token of Test site is refreshed when I reload the page of Test site.\r\n\r\nIs there any problem with sharing prefix of `approot` even there are independent program?\r\n\r\n2. Why Firefox request favicon to Personal sites?\r\n\r\nThe problem about Request something to other site may hard to solve.\r\nI used scaffolding, so there are `favicon.ico` in Test site.\r\nI'm not sure that how a browser find a favicon, but I can guess that Firefox find a favicon from .\r\nHowever, sometimes, test with Google Chrome shows that there are new token when I reloaded. But it works with no problem.\r\n\r\nIt seems to be that Firefox has different request order or different request path about `favicon.ico`, so there is only one problem case."}}