1

OK, so what I'm trying to do may seem like a cross-site attack - defeating the very purpose of CSRF tokens, but here is the need: I have a Symfony app site (app.timo.in) and the plain-PHP homepage web-app (www.timo.in). I wish to allow registered visitors to login from the homepage.

INFO: The app & homepage are on the same domain (timo.in)

A possible option is to generate some other token based on a sharedSecret that both sides can understand. I do not want that the token to expire too soon. One advantage I have is that the login form opens in a modal, so a fresh token can be generated each time, with a short validity. What other parameters do I need to make it secure? If I include session ID, will both sites understand it?

ALERT: I need some sort of CSRF protection, so do not suggest disabling it on the Symfony App's Login page :)

4
  • So what now: You don't want to disable it, or you want to disable it?
    – hakre
    Apr 17, 2012 at 13:19
  • I clarified :) I need CSRF protection. I didn't want fellows to suggest disabling SF token altogether.
    – Prasad
    Apr 17, 2012 at 13:35
  • What is your CSRF protection protecting against?
    – yitznewton
    Apr 18, 2012 at 12:39
  • Some random site trying to post login requests to my app. I can check the HTTP referrer, but not sure that it can't be faked.
    – Prasad
    Apr 18, 2012 at 12:46

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.