7

I validate all my forms data in the model layer but I also check where my form was submitted from (HTTP Referrer) and I also send a token with the form to help prevent Cross Site Request Forgeries and my question is where should these checks be done? In the controller or in the model layer?

I was thinking up a few different ways to accomplish this and one was to have some sort of protected method in my AbstractController for validating the forms source and posted token but then that might break the SRP.

2
  • I vote for controller... the model shouldn't be bound to an environment that it's being used in. If you tucked the checks in the model then what would you do to use the models in say a cron job.
    – Orangepill
    Jun 4, 2013 at 17:30
  • Referrer checking is pretty much a total waste of time. Either you allow null referrers and leave yourself vulnerable, or disallow them and break your app for legitimate users. Synchroniser tokens are a valid measure to defeat CSRF; referrer-checking is not.
    – bobince
    Jun 4, 2013 at 20:03

2 Answers 2

5

(..) where should these checks be done? In the controller or in the model layer?

Neither.

In my humble opinion, CSRF protection should be handled at the same level as other forms of access control: outside the MVC triad.

If application fails to verify the token, it means that data in Request instance (or your alternative of it) cannot be trusted, thus it need to be scrapped. I would perform such check before initialization of Controller and/of View instance.

1
  • Exactly, a CSRF token isn't validating the authority of some user to perform some action. It's validating the integrity of communications in the application itself, and should be treated as such. Jun 4, 2013 at 17:42
2

Basicly it is wise check your data multiple times with different intentions. I suggest these levels:

1) A pre-front-controller checks the data recieved for integrity. If you miss some token, or got some timeout from the browser etc, you exit immediately. You will not let these requests reach your MVC. Here is where you might want suoshin. The reason is, that the deeper levels might communicate secured data with the browser, even on an error. Imagine someone missed a security token (attack?), and your view returns an error message and sets some cookies. Using these, the attacker might be logged in after any invalid form request.

2) The front controller verifies if the entered may be entered in that form from that user etc. (e.g. if a US-User might enter a Canada Phonenumber) It is ment to give direct feedback in form of "please enter a correct phone number" and so on.

3) The model validates if the data is in a state to be safely saved and returned, e.g. if it has been escaped, has the right length etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.