Skip to content

fix(csrf): safely validate decoded token table and fields #14025

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bhuvan-somisetty wants to merge 2 commits into
base: master
Choose a base branch
from
+96 −5
Open

fix(csrf): safely validate decoded token table and fields #14025

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5740694
fix(csrf): safely validate decoded token table and fields
bhuvan-somisetty Oct 10, 2026
f9c8cc8
test(csrf): cover null token and invalid random/sign types
bhuvan-somisetty Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions apisix/plugins/csrf.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ local ngx_decode_base64 = ngx.decode_base64
local ngx_time = ngx.time
local ngx_cookie_time = ngx.cookie_time
local math = math
local type = type
local tonumber = tonumber
local SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}


Expand Down Expand Up @@ -98,18 +100,18 @@ local function check_csrf_token(conf, ctx, token)
end

local token_table, err = core.json.decode(token_str)
if err then
core.log.error("decode token error: ", err)
if err or type(token_table) ~= "table" then
core.log.error("decode token error: ", err or "token is not an object")
return false
end

local random = token_table["random"]
if not random then
if not random or (type(random) ~= "number" and type(random) ~= "string") then
core.log.error("no random in token")
return false
end

local expires = token_table["expires"]
local expires = tonumber(token_table["expires"])
if not expires then
core.log.error("no expires in token")
return false
Expand All @@ -121,7 +123,7 @@ local function check_csrf_token(conf, ctx, token)
end

local sign = gen_sign(random, expires, conf.key)
if token_table["sign"] ~= sign then
if type(token_table["sign"]) ~= "string" or token_table["sign"] ~= sign then
core.log.error("Invalid signatures")
return false
end
Expand Down
89 changes: 89 additions & 0 deletions t/plugin/csrf.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,3 +388,92 @@ apisix:
--- response_body
userkey
mt39FazQccyMqt4ctoRV7w==



=== TEST 16: non-table csrf token (JSON number)
--- request
POST /hello
--- more_headers
apisix-csrf-token: MTIz
Cookie: apisix-csrf-token=MTIz
--- error_code: 401
--- error_log: decode token error
--- no_error_log
attempt to index
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}



=== TEST 17: non-table csrf token (JSON boolean)
--- request
POST /hello
--- more_headers
apisix-csrf-token: dHJ1ZQ==
Cookie: apisix-csrf-token=dHJ1ZQ==
--- error_code: 401
--- error_log: decode token error
--- no_error_log
attempt to index
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}



=== TEST 18: csrf token with invalid non-numeric expires
--- request
POST /hello
--- more_headers
apisix-csrf-token: eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6ImludmFsaWQiLCJzaWduIjoiYWJjIn0=
Cookie: apisix-csrf-token=eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6ImludmFsaWQiLCJzaWduIjoiYWJjIn0=
--- error_code: 401
--- error_log: no expires in token
--- no_error_log
attempt to perform arithmetic
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}
Comment on lines +424 to +435

@Baoyuantop Baoyuantop Oct 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Field guards lack direct test coverage

The tests cover primitive tokens and invalid expires, but not JSON null or invalid random and sign values. Add those cases to exercise every new guard.

@bhuvan-somisetty bhuvan-somisetty Oct 15, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added tests for null tokens and bad random/sign types. Thanks!





=== TEST 19: non-table csrf token (JSON null)
--- request
POST /hello
--- more_headers
apisix-csrf-token: bnVsbA==
Cookie: apisix-csrf-token=bnVsbA==
--- error_code: 401
--- error_log: decode token error
--- no_error_log
attempt to index
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}



=== TEST 20: csrf token with invalid random type
--- request
POST /hello
--- more_headers
apisix-csrf-token: eyJyYW5kb20iOnRydWUsImV4cGlyZXMiOjk5OTk5OTk5OTksInNpZ24iOiJhYmMifQ==
Cookie: apisix-csrf-token=eyJyYW5kb20iOnRydWUsImV4cGlyZXMiOjk5OTk5OTk5OTksInNpZ24iOiJhYmMifQ==
--- error_code: 401
--- error_log: no random in token
--- no_error_log
attempt to concatenate
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}



=== TEST 21: csrf token with invalid sign type
--- request
POST /hello
--- more_headers
apisix-csrf-token: eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6OTk5OTk5OTk5OSwic2lnbiI6MTIzfQ==
Cookie: apisix-csrf-token=eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6OTk5OTk5OTk5OSwic2lnbiI6MTIzfQ==
--- error_code: 401
--- error_log: Invalid signatures
--- response_body
{"error_msg":"Failed to verify the csrf token signature"}
Loading