Back to Questions
1.3k
views7
comments
What kind of story does WebSharper have regarding security?
websharpersecurityremoting

We've been using Scala and Lift for awhile; one of the things that attracted us to it was Lift's emphasis on security. However, we're now looking at alternatives, and WebSharper looks quite attractive.

It would be nice to know a bit more about WebSharper's security features, however. From what I can see, the use of the Text combinator function does HTML escaping and so would defend against XSS attacks. What sort of defenses does WebSharper use against CSRF attacks? How strong is session security? How strong is the security against access to protected pages?

With regard to remoting, I notice the requirement that "RPC-callable methods are safe to call from the web by an unauthenticated client." Is there any plan for implementing secure remoting in the future? Are there other ways to communicate between server and client besides the RPC mechanism?

.

RPC calls are currently not protected against CSRF but Loic has a pull request on GitHub which implements this. I'm not sure if it's already done but it hasn't been merged in just yet.

Sitelet.Protect and the wrapper for user sessions (which is implemented in RpcModule) use FormsAuthentication from System.Web.Security.

Since WebSharper 3.3 we have a quite convenient way of serializing and deserializing JSON data on both server and client side and you can easily define Sitelet endpoints that fit into this communication. This can be used instead of RPCs but it's much lower level (you have to implement the ajax calls yourself) and thus less convinient. You can read about it in our latest blog post.

By on 7/20/2015 12:47 AM ()

BTW, the first set of CSRF features are rolled out in WebSharper 3.4 - see the release notes.

By on 7/31/2015 4:23 PM ()

Just for clarification: If the feature for protecting RPC calls against CSRF is finalized and merged, will that be enough to protect RPC-callable methods so that they can be called securely by authenticated clients?

Also, do formlets and piglets already implement anti-CSRF tokens?

By on 7/21/2015 9:48 PM ()

will that be enough to protect RPC-callable methods so that they can be called securely by authenticated clients?

CSRF and Authentication are managed separately. CSRF (when merged) will be managed automatically via a cookie-to-header token. Authentication is still explicit, like so:

1
2
3
4
5
6
7
8
9

[<Rpc>]
let MySecureFunction (args) =
    let ctx = Web.Remoting.GetContext()
    async {
        let! loggedIn = ctx.UserSession.GetLoggedInUser()
        match loggedIn with
        | Some username -> // We're secure!
        | None -> // Fail gracefully...
    }

Also, do formlets and piglets already implement anti-CSRF tokens?

The typical workflow with formlets and piglets is to call an RPC function in Formlet.Run or Piglet.MapAsync, so these will be protected by the RPC cookie-to-header token. We don't yet have plans for hidden field-based tokens for people who want to submit formlets or piglets using standard form posting.

By on 7/22/2015 1:16 AM ()

Let me add a vote for that. It's too easy accidentally to forget that your form isn't secure if you're doing a standard form post, and you probably wouldn't want attackers deliberately targeting WebSharper sites to see if they have that vulnerability.

By on 7/30/2015 6:04 PM ()

I added this as an enhancement ticket.

By on 7/31/2015 6:10 AM ()

Thanks!

By on 7/20/2015 6:08 AM ()

    Topic tags

    IntelliFactory Offices Copyright (c) 2011-2012 IntelliFactory. All rights reserved.
    Home | Products | Consulting | Trainings | Blogs | Jobs | Contact Us | Terms of Use | Privacy Policy | Cookie Policy     		Built with WebSharper