Use PUT instead of POST to mitigate CSRF

Author: carols10cents

app/adapters/api-token.js

@@ -4,5 +4,14 @@ export default DS.RESTAdapter.extend({
     namespace: 'api/v1/me',
     pathForType() {
         return 'tokens';
-    }
+    },
+    createRecord(store, type, snapshot) {
+        let data = {};
+        let serializer = store.serializerFor(type.modelName);
+        let url = this.buildURL(type.modelName, null, snapshot, 'createRecord');
+
+        serializer.serializeIntoHash(data, type, snapshot, { includeId: true });
+
+        return this.ajax(url, 'PUT', { data });
+    },
 });

src/lib.rs

@@ -206,7 +206,7 @@ pub fn middleware(app: Arc<App>) -> MiddlewareBuilder {
     api_router.get("/me", C(user::me));
     api_router.get("/me/updates", C(user::updates));
     api_router.get("/me/tokens", C(token::list));
-    api_router.post("/me/tokens", C(token::new));
+    api_router.put("/me/tokens", C(token::new));
     api_router.delete("/me/tokens/:id", C(token::revoke));
     api_router.get(
         "/me/crate_owner_invitations",

src/tests/token.rs

@@ -87,7 +87,7 @@ fn list_tokens() {
 #[test]
 fn create_token_logged_out() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     req.with_body(br#"{ "api_token": { "name": "bar" } }"#);
 
@@ -98,7 +98,7 @@ fn create_token_logged_out() {
 #[test]
 fn create_token_invalid_request() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let user = {
         let conn = t!(app.diesel_database.get());
@@ -117,7 +117,7 @@ fn create_token_invalid_request() {
 #[test]
 fn create_token_no_name() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let user = {
         let conn = t!(app.diesel_database.get());
@@ -136,7 +136,7 @@ fn create_token_no_name() {
 #[test]
 fn create_token_long_body() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let user = {
         let conn = t!(app.diesel_database.get());
@@ -149,13 +149,13 @@ fn create_token_long_body() {
     let json: ::Bad = ::json(&mut response);
 
     assert_eq!(response.status.0, 400);
-    assert_contains!(json.errors[0].detail, "max post size");
+    assert_contains!(json.errors[0].detail, "max content length");
 }
 
 #[test]
 fn create_token_exceeded_tokens_per_user() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let user;
     {
@@ -178,7 +178,7 @@ fn create_token_exceeded_tokens_per_user() {
 #[test]
 fn create_token_success() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let user = {
         let conn = t!(app.diesel_database.get());
@@ -211,14 +211,14 @@ fn create_token_multiple_have_different_values() {
     };
 
     let first = {
-        let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+        let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
         ::sign_in_as(&mut req, &user);
         req.with_body(br#"{ "api_token": { "name": "bar" } }"#);
         ::json::<NewResponse>(&mut ok_resp!(middle.call(&mut req)))
     };
 
     let second = {
-        let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+        let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
         ::sign_in_as(&mut req, &user);
         req.with_body(br#"{ "api_token": { "name": "bar" } }"#);
         ::json::<NewResponse>(&mut ok_resp!(middle.call(&mut req)))
@@ -242,14 +242,14 @@ fn create_token_multiple_users_have_different_values() {
     };
 
     let first_token = {
-        let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+        let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
         ::sign_in_as(&mut req, &first_user);
         req.with_body(br#"{ "api_token": { "name": "baz" } }"#);
         ::json::<NewResponse>(&mut ok_resp!(middle.call(&mut req)))
     };
 
     let second_token = {
-        let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+        let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
         ::sign_in_as(&mut req, &second_user);
         req.with_body(br#"{ "api_token": { "name": "baz" } }"#);
         ::json::<NewResponse>(&mut ok_resp!(middle.call(&mut req)))
@@ -261,7 +261,7 @@ fn create_token_multiple_users_have_different_values() {
 #[test]
 fn create_token_with_token() {
     let (_b, app, middle) = ::app();
-    let mut req = ::req(app.clone(), Method::Post, "/api/v1/me/tokens");
+    let mut req = ::req(app.clone(), Method::Put, "/api/v1/me/tokens");
 
     let (user, token);
     {

src/token.rs

@@ -69,7 +69,7 @@ pub fn list(req: &mut Request) -> CargoResult<Response> {
     Ok(req.json(&R { api_tokens: tokens }))
 }
 
-/// Handles the `POST /me/tokens` route.
+/// Handles the `PUT /me/tokens` route.
 pub fn new(req: &mut Request) -> CargoResult<Response> {
     /// The incoming serialization format for the `ApiToken` model.
     #[derive(Deserialize, Serialize)]
@@ -89,12 +89,12 @@ pub fn new(req: &mut Request) -> CargoResult<Response> {
         ));
     }
 
-    let max_post_size = 2000;
+    let max_size = 2000;
     let length = req.content_length()
         .chain_error(|| bad_request("missing header: Content-Length"))?;
 
-    if length > max_post_size {
-        return Err(bad_request(&format!("max post size is: {}", max_post_size)));
+    if length > max_size {
+        return Err(bad_request(&format!("max content length is: {}", max_size)));
     }
 
     let mut json = vec![0; length as usize];