epriestley 42cf7f6faa Make the current session key a component of the CSRF token ... Summary: Fixes T5510. This purely reduces false positives from HackerOne: we currently rotate CSRF tokens, but do not bind them explicitly to specific sessions. Doing so has no real security benefit and may make some session rotation changes more difficult down the line, but researchers routinely report it. Just conform to expectations since the expected behavior isn't bad and this is less work for us than dealing with false positives. Test Plan: - With two browsers logged in under the same user, verified I was issued different CSRF tokens. - Verified the token from one browser did not work in the other browser's session. Reviewers: btrahan Reviewed By: btrahan Subscribers: epriestley Maniphest Tasks: T5510 Differential Revision: https://secure.phabricator.com/D10136		2014-08-04 12:04:47 -07:00
..
PhabricatorAuthSessionEngine.php	Make the current session key a component of the CSRF token	2014-08-04 12:04:47 -07:00