Question

I’m developing a GWT app running on the Google App Engine and wondering if I need to worry about Cross-site request forgery or is that automatically taken care of for me?

For every RPC request that requires authentication, I have the following code:

public class BookServiceImpl extends RemoteServiceServlet implements
BookService {
    public void deleteInventory(Key<Inventory> inventoryKey) throws NotLoggedInException,  InvalidStateException, NotFoundException {
        DAO dao = new DAO();
            // This will throw NotLoggedInException if user is not logged in
        User user = dao.getCurrentUser();
            // Do deletion here
    }
}

public final class DAO extends DAOBase {
    public User getCurrentUser() throws NotLoggedInException {
            currentUser = UserServiceFactory.getUserService().getCurrentUser();
            if(currentUser == null) {
                throw new NotLoggedInException();
            }
        return currentUser;
    }

I couldn’t find any documentation on how the UserService checks authentication. Is it enough to rely on the code above or do I need to to more? I’m a beginner at this, but from what I understand to avoid CSRF attacks some of the strategies are:

1. adding an authentication token in
   the request payload instead of just
   checking a cookie
2. checking the HTTP
   Referer header

I can see that I have cookies set from Google with what look like SID values, but I can’t tell from the serialized Java objects in the payloads if tokens are being passed or not. I also don’t know if the Referer header is being used or not.

So, am I worrying about a non-issue? If not, what is the best strategy here? This is a common enough problem, that there must be standard solutions out there…

Answer 1

If you were to put the same code in a regular servlet, you’d surely be vulnerable to XSRF. But since you are using GWTs RemoteServiceServlet – the answer depends on the version of GWT you are using.

Starting with the yet-to-be-release GWT 2.1, the RPC mechanism adds request headers and validates the presence of these headers in RemoteServiceServlet. This has its limitations – in particular, older versions of flash allow you to send the request headers from a different domain, but it does make things more difficult for a potential attacker.

If you want to adequately protect yourself from XSRF, refer to Lombardi’s Development blog. The blog discusses two techniques. The first is a simple change that ports 2.1 changes to older versions of GWT. The second approach requires duplicating the session identifier as a request parameter, and is the recommended way to protect against XSRF.

References

1. GWT RPC – Does it do enough to protect against CSRF?
2. Lombardi development blog on GWT RPC and XSRF
3. Security for GWT Applications