5

I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.

I am wondering about the necessity of this measure on site-search forms specifically, including core's search_box() and search_form() as well as a form built from scratch in a module that similarly implements a search by feeding arguments into a view.

I have seen it mentioned (in drupal_prepare_form(), in fact, and possibly other places I can't recall) that the search forms would be a viable case in which to work around the token protection. But then, why doesn't core do so by default?

(Note: I'm not asking for help with code to work around it, as I've figured that part out already.)

3

I think the biggest question when judging a potential CSRF problem is whether some form of damage will be done if a user is tricked into taking the action. If there is a CSRF vulnerability that deletes a user or unpublishes a node, that would be a problem. But being tricked into executing a search is only potentially a problem in terms of the resources a search takes to execute (which is not that much). Even if the core search doesn't bypass the token, it is accessible as a GET url (search/node/keyword) so someone could be tricked into visiting that URL bypassing the form in front.

Another way to think about it is whether the action is idempotent. A search is an idempotent action (by the W3 definition, log records might be created, but that's not a big deal), so it doesn't need CSRF protection.

  • Thanks for answering this. Is the token protection on the core search just because Drupal protects all forms by default? – mpdonadio Jun 6 '12 at 13:08
  • @MPD - yes, I believe that's the case. – greggles Jun 13 '12 at 14:32
0

This seems to bring about reasons why you should never bypass #token: CSRF: Avoid security holes in your Drupal forms.

And the specific instances you've provided don't seem to warrant bypassing #token.

  • 2
    The pixeljets article doesn't support your claim (and isn't a particularly great article, tbh). IMO it is totally appropriate to bypass CSRF in this instance. – greggles Jun 6 '12 at 11:41
  • Does #token reduce functionality in searches? I think I'm starting to understand why it would be safe, but I still don't quite get what the benefit of bypassing #token is. – Johnathan Elmore Jun 6 '12 at 20:53
  • @JohnathanElmore, bypassing #token lets do AJAX login w/o needing to rebuilding search forms. – mpdonadio Jun 7 '12 at 14:24
  • Had some link rot, new link is pixeljets.com/blog/… – fullerja May 24 '17 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.