CSRF on /login security alert from security scans

[david (David Taylor)]

@jlaura

I need to prove to the security team that the /login page is actually protected.

The full source code is available at GitHub - discourse/discourse: A platform for community discussion. Free, open, simple. · GitHub

From our security document:

CSRF allows malicious sites to perform HTTP requests in the context of a forum user without their knowledge – mostly by getting users who already hold a valid forum login cookie to click a specific link in their web browser.

Discourse extends the built-in Rails CSRF protection in the following ways:

1. By default any non GET requests ALWAYS require a valid CSRF token. If a CSRF token is missing Discourse will raise an exception.
2. API calls using the secret API bypass CSRF checks.
3. Certain pages are “cachable”, we do not render the CSRF token ( <meta name='csrf-token' ... ) on any cachable pages. Instead when users are about to perform the first non GET request they retrieve the token just in time via GET session/csrf