{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/22263","labels_url":"https://api.github.com/repos/rails/rails/issues/22263/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/22263/comments","events_url":"https://api.github.com/repos/rails/rails/issues/22263/events","html_url":"https://github.com/rails/rails/pull/22263","id":116371836,"number":22263,"title":"Add option to verify Origin header in CSRF checks","user":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"labels":[],"state":"open","locked":false,"assignee":{"login":"jeremy","id":199,"avatar_url":"https://avatars.githubusercontent.com/u/199?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremy","html_url":"https://github.com/jeremy","followers_url":"https://api.github.com/users/jeremy/followers","following_url":"https://api.github.com/users/jeremy/following{/other_user}","gists_url":"https://api.github.com/users/jeremy/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremy/subscriptions","organizations_url":"https://api.github.com/users/jeremy/orgs","repos_url":"https://api.github.com/users/jeremy/repos","events_url":"https://api.github.com/users/jeremy/events{/privacy}","received_events_url":"https://api.github.com/users/jeremy/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-11-11T16:35:05Z","updated_at":"2015-11-11T23:22:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/22263","html_url":"https://github.com/rails/rails/pull/22263","diff_url":"https://github.com/rails/rails/pull/22263.diff","patch_url":"https://github.com/rails/rails/pull/22263.patch"},"body":"We're trying to upstream some of the CSRF improvements we've made at GitHub. This first one is pretty simple. It checks the `Origin` header, if present, against `request.base_url` during the CSRF checks. This isn't *fixing* any existing problem, but adds another layer of defense to the Rails CSRF mitigations.\r\n\r\n/cc @oreoshake @ptoomey3"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/155941276","html_url":"https://github.com/rails/rails/pull/22263#issuecomment-155941276","issue_url":"https://api.github.com/repos/rails/rails/issues/22263","id":155941276,"user":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"created_at":"2015-11-11T23:22:37Z","updated_at":"2015-11-11T23:22:37Z","body":"I wrote a little Sinatra app to help test the Origin header behavior in different browsers:\r\n\r\n```ruby\r\nrequire \"sinatra\"\r\nrequire \"useragent\"\r\nrequire \"json\"\r\n\r\nget \"*\" do\r\n<<HERE\r\n<html>\r\n  <head>\r\n    <script>\r\n      window.addEventListener('load', function(){\r\n        document.querySelector('form').submit()\r\n      })\r\n    </script>\r\n  </head>\r\n  <body>\r\n    <form action=\"/\" method=\"post\">\r\n    </form>\r\n  </body>\r\n</html>\r\nHERE\r\nend\r\n\r\npost \"*\" do\r\n  JSON.dump(\r\n    :browser  => UserAgent.parse(request.env['HTTP_USER_AGENT']).browser,\r\n    :origin   => request.env['HTTP_ORIGIN'],\r\n    :base_url => request.base_url\r\n  )\r\nend\r\n```\r\n\r\nHere's my results for port 80 and port 4567:\r\n\r\n<img width=\"620\" alt=\"screen shot 2015-11-11 at 6 15 23 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106054/11ea71ea-88a1-11e5-9b64-89fbea283864.png\">\r\n<img width=\"599\" alt=\"screen shot 2015-11-11 at 6 16 08 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106057/11ece89e-88a1-11e5-95b5-7698be4703bf.png\">\r\n<img width=\"578\" alt=\"screen shot 2015-11-11 at 6 16 27 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106052/11e89370-88a1-11e5-90d2-6be691898fc3.png\">\r\n<img width=\"614\" alt=\"screen shot 2015-11-11 at 6 16 51 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106056/11eb417e-88a1-11e5-9064-44b9ad39d555.png\">\r\n<img width=\"482\" alt=\"screen shot 2015-11-11 at 6 17 00 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106053/11e94ca2-88a1-11e5-9dfe-f3498a33f59e.png\">\r\n<img width=\"485\" alt=\"screen shot 2015-11-11 at 6 17 11 pm\" src=\"https://cloud.githubusercontent.com/assets/1144197/11106055/11eacf00-88a1-11e5-8d9d-5ae54bc12a25.png\">\r\n\r\nI haven't tested this with IE or over HTTPS."}}