Re: [EP-tech] CSRF
"Newman D.R. via Eprints-tech" <[email protected]>
| Newsgroups | gmane.comp.web.eprints.devel |
|---|---|
| Message-ID | <EMEW3|75c0a0805732ac0e33850f90cad58b0fvA6CDs03drn|ecs.soton.ac.uk|[email protected]> |
Hi Maher, This depends if you have just created a new repository/archive or if you have upgraded to 3.4.1 for an existing archive. For the latter you will need to manually copy EPRINTS_PATH/lib/defaultcfg_zero/cfg.d/csrf_protection.pl to you archive (i.e. EPRINTS_PATH/archives/ARCHIVE_NAME/cfg.d/csrf_protection.pl). Otherwise csrf_protection.pl should have automatically added to you archive on creation. Either way it is best you change the csrf_token_salt config variable to something else. Generating a suitable token salt can be done using OpenSSL: openssl rand -base64 8 8 characters should be more than sufficient, as the current time is also used in generating each token. Using the default token salt gives you improved security but is not ideal as a determined hacker could work out valid tokens they could use. Regards David Newman On 07/11/2019 11:54, Maher Abdellatif Ahmad Qahwash via Eprints-tech wrote: Hi We are running eprints 3.4.1 and would like know if CSRF is enabled by default or we need to enable it in the configuration? Thanks Maher *** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech *** Archive: http://www.eprints.org/tech.php/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.eprints.org%2Ftech.php%2F&data=01%7C01%7C%7C03f14f56d07e4336d14408d7637bdd29%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=5AuNy97xqjXuXsHIoYB%2BmmkuAOTkWOo3ZEjUCyJcCoA%3D&reserved=0> *** EPrints community wiki: http://wiki.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.eprints.org%2F&data=01%7C01%7C%7C03f14f56d07e4336d14408d7637bdd29%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=TWio0NYpBJrdy6NTvRifpqYF1xEgfSeBTVA1b8Km0vI%3D&reserved=0> *** EPrints developers Forum: http://forum.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fforum.eprints.org%2F&data=01%7C01%7C%7C03f14f56d07e4336d14408d7637bdd29%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=V32vlLOkMDQypjBwkRazWdbMfv96o1ANpWeSdKq7MEs%3D&reserved=0> *** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech *** Archive: http://www.eprints.org/tech.php/ *** EPrints community wiki: http://wiki.eprints.org/ *** EPrints developers Forum: http://forum.eprints.org/