Olivier Dony
1af543a399
Our CSRF tokens are based on the current user session, and automatically expire as soon as the session does. However, they also come with a default 1h expiration delay. This proves to be a frequent annoyance for users who pause more than 1h on a form before submitting it (e.g. user logs out and browser sits on login page until the next day). It can even lead to blocking bugs, e.g. when the 1h expiration occurs in the middle of taking a survey exam, and the user is never able to post the answers that are only present in the state of the form they need to post. More generally, users have a hard time understanding those CSRF expiration errors, and don't know how to react. Longer default expiration times have been considered (e.g. 1 day or 1 week) but those would not bring any identified benefit in terms of security, while still giving a chance that some users would experience the incomprehensible HTTP 400 errors). Attacks that can typically compromise the CSRF token (XSS, RCE) can achieve as much, or more, on the system or user account than what is possible with the token. And nothing generally prevents the attacker from using the token immediately after capturing it, during the initial attack, making the expiration delay rather irrelevant. Given there seems to be no significant benefit in expiring the tokens before the session itself, let's just keep them valid as long as the session. Note: sessions are GC'd automatically after 7 days of inactivity, which gives an effective 1 week expiry for abandoned web forms anyway, as the token expires with the session. Additionally, fix `survey` module tests, that were using an incorrect regex for extracting CSRF tokens. closes odoo/odoo#51499 Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials