CSRF token on login

[daviian]

• Gitea version (or commit ref): f61a1d2
• Git version: 2.13.3
• Operating system: Mac OS X
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant

Description

After discussion in #2363 (review) I checked if login is validating CSRF token. And it does not.
As opinions differ I want to start a discussion about the necessity of a token validation for login request.

A research lead me to https://stackoverflow.com/questions/6412813/do-login-forms-need-tokens-against-csrf-attacks/15350123#15350123, the guy describes a scenario in which not validating the csrf token on login page is used for an attack on data privacy.

What's your opinion on this guys? IMO I would add token validation for login.

[daviian]

Anyone against a CSRF token on login?
If not I would create a PR for this,

[lunny]

@daviian maybe because drone depends on that?

[daviian]

@lunny Any reason why the drone should depend on that?

[lunny]

@daviian since Gitea didn't implement OAuth2 provider. But drone need login with gitea user & password.

[daviian]

@lunny When does the drone need direct login to gitea, except when running integration tests? And integration tests already send csrf token on login, although the token is not validated.

[6543]

Gitea has implemented OAuth2 provider