Use header-only forgery protection and cache complete responses

test/controllers/cached_responses_test.rb

@@ -14,7 +14,7 @@ class CachedResponsesTest < ActionDispatch::IntegrationTest
     Rails.cache = ActiveSupport::Cache::MemoryStore.new
     ActionController::Base.perform_caching = true
     @room = rooms(:watercooler)
-    # Establish last-room and CSRF cookies before checking reuse.
+    # Establish last-room cookies before checking reuse.
     2.times { get room_url(@room) }
     ResponseCache.instance.clear
   end
@@ -48,37 +48,54 @@ class CachedResponsesTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
-  test "clients without a persisted CSRF session still reuse token-neutral HTML" do
+  test "clients without token state reuse complete HTML and post without tokens" do
     cookies["_campfire_session"] = @login_cookie
     get room_url(@room)
-    first = css_select('meta[name="csrf-token"]').first["content"]
+    first = response.body
+    assert_select 'meta[name="csrf-token"]', count: 0
+    assert_select 'input[name="authenticity_token"]', count: 0
     cookies["_campfire_session"] = @login_cookie
     ResponseCache.instance.expects(:write).never
     get room_url(@room)
-    second = css_select('meta[name="csrf-token"]').first["content"]
     assert_response :success
-    assert_not_equal first, second
-    assert_no_match /campfire-csrf-/, response.body
+    assert_equal first, response.body
     post room_messages_url(@room, format: :turbo_stream), params: {
-      authenticity_token: second, message: { body: "fresh replay token works", client_message_id: "cache-replay-token" } }
+      message: { body: "tokenless replay works", client_message_id: "cache-replay" } },
+      headers: { "Sec-Fetch-Site" => "same-origin", "Origin" => "http://once.campfire.test" }
     assert_response :success
   end
 
-  test "cached tokens stay fresh and literal token-like text survives" do
-    get room_url(@room)
-    literal = css_select('meta[name="csrf-token"]').first["content"]
+  test "literal token-like text survives complete page reuse" do
+    literal = "campfire-csrf-literal authenticity_token csrf-token"
     @room.messages.create!(creator: users(:david), body: "literal #{literal}")
     get room_url(@room)
-    first = css_select('meta[name="csrf-token"]').first["content"]
+    first = response.body
     get room_url(@room)
-    second = css_select('meta[name="csrf-token"]').first["content"]
-    assert_not_equal first, second
+    assert_equal first, response.body
     assert_includes response.body, "literal #{literal}"
-    assert_no_match /campfire-csrf-/, response.body
+  end
 
-    post room_messages_url(@room, format: :turbo_stream), params: {
-      authenticity_token: second, message: { body: "cached token works", client_message_id: "cache-token" } }
-    assert_response :success
+  test "gzip bytes are reused and identity negotiation stays separate" do
+    require "stringio"
+    get room_url(@room), headers: { "Accept-Encoding" => "gzip" }
+    assert_equal "gzip", response.headers["Content-Encoding"]
+    encoded = response.body
+    decoded = Zlib::GzipReader.new(StringIO.new(encoded)).read
+    assert_includes decoded, "<html"
+    assert_includes response.headers["Vary"], "Accept-Encoding"
+    get room_url(@room)
+    assert_equal decoded, response.body
+    ResponseCache.instance.expects(:write).never
+    get room_url(@room), headers: { "Accept-Encoding" => "gzip" }
+    assert_equal encoded, response.body
+    get room_url(@room)
+    assert_nil response.headers["Content-Encoding"]
+    assert_equal decoded, response.body
+    get room_url(@room), headers: { "Accept-Encoding" => "gzip;q=0, identity;q=1" }
+    assert_nil response.headers["Content-Encoding"]
+    assert_equal decoded, response.body
+    get room_url(@room), headers: { "Accept-Encoding" => "*;q=0" }
+    assert_nil response.headers["Content-Encoding"]
   end
 
   test "local and foreign commits invalidate pages and nested fragments" do

test/controllers/fetch_metadata_test.rb

@@ -0,0 +1,91 @@
+require "test_helper"
+
+class FetchMetadataTest < ActionDispatch::IntegrationTest
+  setup do
+    host! "once.campfire.test"
+    @previous_exceptions = Rails.application.env_config["action_dispatch.show_exceptions"]
+    Rails.application.env_config["action_dispatch.show_exceptions"] = :rescuable
+    @previous_forgery = ActionController::Base.allow_forgery_protection
+    ActionController::Base.allow_forgery_protection = true
+  end
+
+  teardown do
+    ActionController::Base.allow_forgery_protection = @previous_forgery
+    Rails.application.env_config["action_dispatch.show_exceptions"] = @previous_exceptions
+  end
+
+  test "login and authenticated forms have no token fields" do
+    get new_session_url
+    assert_response :success
+    assert_select 'meta[name="csrf-token"]', count: 0
+    assert_select 'input[name="authenticity_token"]', count: 0
+    sign_in :david
+    get room_url(rooms(:watercooler))
+    assert_response :success
+    assert_select 'meta[name="csrf-token"]', count: 0
+    assert_select 'input[name="authenticity_token"]', count: 0
+  end
+
+  test "HTTPS login accepts browser metadata without a token" do
+    https!
+    %w[ same-origin same-site ].each do |site|
+      reset!
+      host! "once.campfire.test"
+      https!
+      post session_url, params: credentials, headers: {
+        "Sec-Fetch-Site" => site, "Origin" => "https://once.campfire.test" }
+      assert_response :redirect
+      assert cookies["session_token"].present?
+    end
+  end
+
+  test "HTTPS writes reject missing metadata even with a legacy token parameter" do
+    https!
+    assert_no_difference "Session.count" do
+      post session_url, params: credentials.merge(authenticity_token: "old token"), headers: { "Origin" => "https://once.campfire.test" }
+    end
+    assert_response :unprocessable_entity
+  end
+
+  test "cross-site none and malformed metadata cannot sign in over HTTP or HTTPS" do
+    [ false, true ].each do |tls|
+      https! tls
+      %w[ cross-site none garbage ].each do |site|
+        assert_no_difference "Session.count" do
+          post session_url, params: credentials, headers: { "Sec-Fetch-Site" => site }
+        end
+        assert_response :unprocessable_entity
+      end
+    end
+  end
+
+  test "provided foreign and null origins fail even with same-site metadata" do
+    %w[ https://foreign.example null ].each do |origin|
+      assert_no_difference "Session.count" do
+        post session_url, params: credentials, headers: { "Sec-Fetch-Site" => "same-site", "Origin" => origin }
+      end
+      assert_response :unprocessable_entity
+    end
+  end
+
+  test "plain HTTP retains the missing-header fallback" do
+    post session_url, params: credentials, headers: { "Origin" => "http://once.campfire.test" }
+    assert_response :redirect
+    assert cookies["session_token"].present?
+  end
+
+  test "cross-site reads remain available and method-overridden writes stay protected" do
+    get new_session_url, headers: { "Sec-Fetch-Site" => "cross-site" }
+    assert_response :success
+    sign_in :david
+    assert_no_difference "Room.count" do
+      post room_path(rooms(:watercooler)), params: { _method: "delete" }, headers: { "Sec-Fetch-Site" => "cross-site" }
+    end
+    assert_response :unprocessable_entity
+  end
+
+  private
+    def credentials
+      { email_address: users(:david).email_address, password: "secret123456" }
+    end
+end

test/performance/chatter.js

@@ -87,18 +87,16 @@ export function sockets() {
 export function messages() {
   const cookie = `session_token=${dummyCookies[0][0]}`;
 
-  const response = http.get(`http://${host}${port}/rooms/1`, { headers: { "Cookie": cookie }, responseType: "text" });
-  const csrfToken = response.body.match(/<meta name="csrf-token" content="([^"]*)"/i)[1];
-
   const postHeaders = {
     "Cookie": cookie,
+    "Sec-Fetch-Site": "same-origin",
+    "Origin": `http://${host}${port}`,
     "Accept": "text/vnd.turbo-stream.html, text/html, application/xhtml+xml"
   }
 
   const payload = {
     "message[body]": "Hello from k6",
-    "message[client_message_id]": Math.random().toString(36),
-    "authenticity_token": csrfToken
+    "message[client_message_id]": Math.random().toString(36)
   };
 
   for (let i = 0; i < 100; i++) {