Add Default Filters for CSRF Tokens

[davydotcom]

Grails web profile is lacking in a lot of areas that could be some nice default enhancements to help developers prevent surprises down the line in their development. One of these is the use of CSRF tokens. There is a built in feature with the withForm method in a controller as well as useToken="true" on a form but this really should be automatic. By turning on the Spring Boot CSRF Filter and providing some default beans for matchers this could be easily automated in a way that the user doesn't have to explicitly think about CSRF.

[davydotcom]

Example of beans we register to solve this:

import org.springframework.security.web.csrf.CsrfFilter

fnAccessDeniedHandler(MorpheusCustomAccessDeniedHandler)
    fnRequireCsrfProtectionMatcher(MorpheusCsrfRequestMatcher)
    csrfFilter(CsrfFilter, new HttpSessionCsrfTokenRepository()) {
        accessDeniedHandler = ref('fnAccessDeniedHandler')
        requireCsrfProtectionMatcher = ref('fnRequireCsrfProtectionMatcher')
    }

A custom access denied handler can inject flash messages or be customizable:

package com.morpheus.security

import groovy.util.logging.Slf4j
import org.springframework.security.access.AccessDeniedException
import org.springframework.security.web.access.AccessDeniedHandler

import javax.servlet.ServletException
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse
import grails.web.mvc.FlashScope
import org.springframework.web.context.request.RequestContextHolder
import org.grails.web.servlet.mvc.GrailsWebRequest 

@Slf4j
public class MorpheusCustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(
		HttpServletRequest request,
		HttpServletResponse response,
		AccessDeniedException exc) throws IOException, ServletException {

    	String requestedWithHeader = request.getHeader("X-Requested-With");
    	String referrer = request.getHeader("referer");
    	GrailsWebRequest grailsRequest = RequestContextHolder.currentRequestAttributes()
    	FlashScope flash = grailsRequest.getFlashScope()
    	// GrailsHttpSession session = request.session
        if(requestedWithHeader == null || !requestedWithHeader.equals("XMLHttpRequest")) {
            if(referrer) {
            	flash.error = "Invalid CSRF Token"
            	response.sendRedirect(referrer);	
        	} else {
        		response.sendRedirect(request.getContextPath() + "/error/access-denied");	
        	}
        } else {
        	response.sendRedirect(request.getContextPath() + "/error/access-denied");	
        }

        
    }
}

And a request matcher can be properly defined to exclude certain routes based on configuration or exclude certain request methods

package com.morpheus.security

import org.springframework.security.web.util.matcher.RequestMatcher
import javax.servlet.http.HttpServletRequest
import java.util.regex.Pattern;
public class MorpheusCsrfRequestMatcher implements RequestMatcher {

    // Always allow the HTTP GET method
    private Pattern allowedMethods = Pattern.compile(/^GET$/);

    @Override
    public boolean matches(HttpServletRequest request) {
        if (allowedMethods.matcher(request.getMethod()).matches()) {
            return false;
        }
	if(request.getRequestURI().startsWith('/api')) {
		return false;
	}
        if(request.getRequestURI().startsWith('/console')) {
            return false;
        }
        if(request.getRequestURI().startsWith('/oauth')) {
            return false;
        }
        return true;
    }

}

Also a csrf.js can be added to auto inject csrf tokens into ajax calls:

$(function () {
    var token = $("meta[name='_csrf']").attr("content");
    var header = $("meta[name='_csrf_header']").attr("content");
    $(document).ajaxSend(function(e, xhr, options) {
    	if (header) {
        	xhr.setRequestHeader(header, token);
    	}
    });
});

These tokens can be set in the default main layout in the template

<meta name="_csrf_header" content="${_csrf?.headerName}"/>
<meta name="_csrf_parameter" content="${_csrf?.parameterName}"/>

and g:form can auto inject the csrf parameter hidden field at all times.