A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that.

Also, when credentials are submitted, cas generates a token in URL form. If I copy this URL and use it later, the user is authenticated and redirected to the home page.

As I'm not logging in, but just using the token URL, why is this happening? Is this a security vulnerability?

  • 1
    I don't know CAS but knowing similar technologies, I strongly suspect the answer is "no". The application needs to have its own CSRF protection. You can do this in struts using the token interceptor, and placing s:token tags in all forms. nickcoblentz.blogspot.co.uk/2008/11/… – paj28 Jun 6 '14 at 10:53
  • @paj28: Yes I have seen that link before, but want to confirm if we are not doing repetition. There may be a chance that CAS provides a mechanism for that. – user235498 Jun 6 '14 at 10:58
  • Personally, I'd do a quick pen test to check if it's vulnerable, just on one form. This may not be great advice for you if you're not a pen tester, but here's a relevant methodology: owasp.org/index.php/Testing_for_CSRF_(OWASP-SM-005) – paj28 Jun 6 '14 at 11:00

This is old, but must...get...internet...points...

Maybe you're just referring to CSRF protection on the login page, but if you mean in general:

I'm still new to the CAS protocol, but my understanding is that the only time validation happens is at the beginning before you have a session id in the service application itself. Once this is generated, no more contact with the CAS server is needed and no service ticket is needed, so CAS's ST cannot protect you from CSRF attacks.

See: https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html

I imagine the token you mention is the "ST" (service ticket) parameter. Again, new to this stuff, but it sounds to me like you shouldn't be able to use that more than once, so maybe that is/was a bug, or maybe the spec has changed:


However, if you still have your session cookie, you don't need the ST, so maybe that was producing that behavior.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.