id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	launchpad_bug
98	Web API is vulnerable to XSRF attacks.	nejucomo	zooko	"the current web-api is susceptible to cross-site reference forgery (XSRF) attacks [1].

An example attack scenario looks like this:  The attacker expects the victim to be a Tahoe user and wants to read their harddrive, and knows they have a fetish for nuclear warhead HOWTO / porn mashups.

So they create NudieNukeHOWTOS.com and put an enticing link text with a url target that PUT's the user's root directory to Tahoe.

In order to prevent this kind of attack requires (I believe) that users cannot cut'n'paste URLs into their browser to initiate Tahoe actions.  This might explicitly be counter to the design goals.  A workaround is to require the users to cut'n'paste into an entry form within the web UI (see below).

One technical solution is for the Web UI and API to associate an unguessable string with each action-triggering URL.  These strings are provided to the browser (such as with a hidden input field) or the webapi client (perhaps in a header) and verified before executing actions.

If we want the use case of Alice sending Bob an email that says: ""Hey download my great Tahoe photo directory with this URI: ..."", we can require Bob to paste this string into an input field in the Web UI *instead* of the location bar.  (Even this might be vulnerable...  I'm not sure of the capabilities of javascript and the like...)


References:
[1] http://en.wikipedia.org/wiki/XSRF
"	defect	closed	major	0.5.1	code-frontend-web	0.4.0	fixed	security