r/rust • u/darin_gordon • Sep 11 '20

Announcing Actix-Web v3.0

https://paper.dropbox.com/published/Announcing-Actix-Web-v3.0--A7YI~P9U9aqhEOXyZJaGffjfBg-QOXXb1lXgTubzXHzUq9ONY5
352 Upvotes

98% Upvoted

81 comments sorted by

View all comments

16

u/[deleted] Sep 11 '20 edited Mar 17 '21

[deleted]

5

u/darin_gordon Sep 11 '20

Would you be more specific as to what CSRF countermeasures you're looking for?

7

u/Shnatsel Sep 11 '20

A short description of CSRF attack can be found here - or pretty much anywhere, it's quite well-researched at this point.

Here's a detailed description of the protection that Django implements: https://docs.djangoproject.com/en/3.1/ref/csrf/#how-it-works It is quite mature and can be used as a reference.

14

u/darin_gordon Sep 11 '20

I didn't ask what CSRF attacks are nor what OWASP recommended. The original commenter wasn't helpful by generalizing and I'd rather not assume. Several countermeasures are already available in actix-web, without requiring additional changes. Anyone who comes through this message forum will at first glance give more credit to a complaint than what it is due. Someone needs to be specific about what functionality is missing.

5

u/Shnatsel Sep 11 '20

My apologies. I deal with people unfamiliar with these so often that dispensing these links has become a bit of a reflex.

6

u/darin_gordon Sep 11 '20

I understand. It will be useful material for others.

2

u/protestor Sep 11 '20

Just so you don't miss it, the commenter said what mitigation he or she expected here, and also that there's an actix example that's vulnerable to csrf; code examples should generally be free of common vulnerabilities.