安全扫描期间的CSRF令牌cookie漏洞

Question

I am making a simple website for my employer using Django, and I had to run the code through a security scan to test for vulnerabilities. One of the issues is cookie vulnerabilities that I can find documentation to find for.

The cookie vulnerabilities are raised when logging in to my website.

Here is the error - the scan is run by OCIO-Internet-Scan

CVSS: 5.0 Message: csrftoken Cookie has problem(s) csrftoken = J4S6ZO7ssz4TUIlRNv9d95mCFomAbXO1; Host = [removed] Path = / J4S6ZO7ssz4TUIlRNv9d95mCFomAbXO1; Host = [removed] Path = /

1. Cookie can be cached.
2. Cookie is persistent. Cookie expires at : Wed, 07 Jun 2017

Persistent session-handling cookies: When a session-handling cookie is set persistently, it allows the cookie to be valid even after a user terminates a session. Therefore an attacker can use a session cookie stored as a text file by the browser to access restricted information. Cacheable cookies: A cachable cookie could be cached at a proxy or a gateway. It can result in serving a cookie value that is out of date or stale. An attacker may also steal such cookies if he has compromised that proxy or gateway.

My question is, where exactly can I make changes to the csrftoken behavior for this? I can't find it using google, and I cannot bring the website up until this is fixed. Am I even able to change how csrf acts to accommodate these errors?

Answer 1

It sounds like you want to change the CSRF_COOKIE_AGE setting to None :

Default: 31449600 (approximately 1 year, in seconds)

The age of CSRF cookies, in seconds.

The reason for setting a long-lived expiration time is to avoid problems in the case of a user closing a browser or bookmarking a page and then loading that page from a browser cache. Without persistent cookies, the form submission would fail in this case.

Some browsers (specifically Internet Explorer) can disallow the use of persistent cookies or can have the indexes to the cookie jar corrupted on disk, thereby causing CSRF protection checks to (sometimes intermittently) fail. Change this setting to None to use session-based CSRF cookies, which keep the cookies in-memory instead of on persistent storage.

That will cause it to be a session cookie instead of a persistent cookie. Session cookies don't have an expiration date so the browser holds them in memory for the current browser session only and then deletes them when the session is over.

You can find info on how to change the Django setting here .