From 3b9b695ef1ac604d427eef23b608eec25c9ef490 Mon Sep 17 00:00:00 2001
From: Matthias Grundmann <matthias.grundmann@kit.edu>
Date: Tue, 12 Jun 2018 17:35:00 +0200
Subject: [PATCH] Check host header instead of origin which might not be
present #475
---
.../main/java/org/owasp/webgoat/plugin/CSRFFeedback.java | 6 +++---
.../java/org/owasp/webgoat/plugin/CSRFFeedbackTest.java | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFFeedback.java b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFFeedback.java
index 0acd8bbfe..501da489b 100644
--- a/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFFeedback.java
+++ b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFFeedback.java
@@ -64,11 +64,11 @@ public class CSRFFeedback extends AssignmentEndpoint {
private boolean hostOrRefererDifferentHost(HttpServletRequest request) {
String referer = request.getHeader("referer");
- String origin = request.getHeader("origin");
+ String host = request.getHeader("host");
if (referer != null) {
- return !referer.contains(origin);
+ return !referer.contains(host);
} else {
- return true; //this case referer is null or origin does not matter we cannot compare so we return true which should of course be false
+ return true;
}
}
diff --git a/webgoat-lessons/csrf/src/test/java/org/owasp/webgoat/plugin/CSRFFeedbackTest.java b/webgoat-lessons/csrf/src/test/java/org/owasp/webgoat/plugin/CSRFFeedbackTest.java
index 495a2cf9b..cb5edba91 100644
--- a/webgoat-lessons/csrf/src/test/java/org/owasp/webgoat/plugin/CSRFFeedbackTest.java
+++ b/webgoat-lessons/csrf/src/test/java/org/owasp/webgoat/plugin/CSRFFeedbackTest.java
@@ -46,7 +46,7 @@ public class CSRFFeedbackTest extends LessonTest {
mockMvc.perform(post("/csrf/feedback/message")
.contentType(MediaType.TEXT_PLAIN)
.cookie(new Cookie("JSESSIONID", "test"))
- .header("origin", "localhost:8080")
+ .header("host", "localhost:8080")
.header("referer", "webgoat.org")
.content("{\"name\": \"Test\", \"email\": \"test1233@dfssdf.de\", \"subject\": \"service\", \"message\":\"dsaffd\"}"))
.andExpect(jsonPath("lessonCompleted", is(true)))