# /login における CSRF のセキュリティスキャンによる警告

**URL:** <https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667>\
**Category:** Self-hosting\
**Created:** [2018 年 12 月 19 日午後 1:23 UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667 "2018-12-19T13:23:42Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![jlaura](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jlaura](https://meta.discourse.org/u/jlaura)\
**Post date:** [2018 年 12 月 19 日午後 1:23 UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667/1 "2018-12-19T13:23:43Z")

</div>

I am using discourse via docker containers in a local docker swarm. The installation went smoothly and we have been able to get a working prototype deployed within a super short period of time. Thanks for the great docs!

We then needed to get our business security scans run to be able to set up the proper proxies for getting discourse accessible via the outside world. All went well, except for a missing CSFR protection on /login. We have the local logins enabled and are being alerted that the `/login` url (looks like it is linked to the nice login window that is presented over the main page on login request) does not appear to have CSRF protection.

We are deployed behind a firewall, so access to Github to use the Git OAuth is not possible. That said, I have enabled it because we can watch the authentication attempt as the request hits Github and then see the failure logged in production.log (expected because Git has not access back to our discourse install). I mention this because the login attempt to GitHub includes CSRF protection, but the local login does not.

Local:

```
Started GET "/login.html?_=1545151335383" for xxx.xxx.xxx.xxx at 2018-12-18 16:42:15 +0000
Processing by StaticController#show as HTML
  Parameters: {"_"=>"1545151335383", "id"=>"login"}
  Rendering static/login.html.erb
  Rendered static/login.html.erb (19.5ms)

```

GitHub:

```
Started GET "/auth/github" for xxx.xxx.xxx.xxx at 2018-12-18 18:34:32 +0000
(github) Setup endpoint detected, running now.
(github) Request phase initiated.
Started GET "/auth/github/callback?code=AUTHCODE" for xxx.xxx.xxx.xxx at 2018-12-18 18:34:52 +0000
(github) Setup endpoint detected, running now.
(github) Callback phase initiated.
(github) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
Started GET "/auth/failure?message=csrf_detected&strategy=github" for xxx.xxx.xxx.xxx at 2018-12-18 18:34:52 +0000
Processing by Users::OmniauthCallbacksController#failure as HTML
  Parameters: {"message"=>"csrf_detected", "strategy"=>"github"}
  Rendering users/omniauth_callbacks/failure.html.erb within layouts/no_ember
  Rendered users/omniauth_callbacks/failure.html.erb within layouts/no_ember (0.7ms)
  Rendered layouts/_head.html.erb (7.4ms)
  Rendered common/_discourse_stylesheet.html.erb (0.2ms)
  Rendered application/_header.html.erb (0.1ms)

```

Is /login missing CSRF protection or have we missed an installation step?

---

_[View the full topic](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667)._