feat: add CSRF plugin

apisix/plugins/csrf.lua

@@ -0,0 +1,168 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local resty_sha256 = require("resty.sha256")
+local ck = require("resty.cookie")
+local ngx = ngx
+local plugin_name = "csrf"
+local ngx_encode_base64 = ngx.encode_base64
+local ngx_decode_base64 = ngx.decode_base64
+local timer = ngx.time
+local cookie_time = ngx.cookie_time
+local math = math
+
+local schema = {
+    type = "object",
+    properties = {
+      key = {
+        description = "use to generate csrf token",
+        type = "string",
+      },
+      expires = {
+        description = "expires time for csrf token",
+        type = "integer",
+        default = 7200
+      },
+      name = {
+        description = "the csrf token name",
+        type = "string",
+        default = "apisix_csrf_token"
+      }
+    },
+    required = {"key"}
+}
+
+local _M = {
+    version = 0.1,
+    priority = 3500,
+    name = plugin_name,
+    schema = schema,
+}
+
+function _M.check_schema(conf)
+    return core.schema.check(schema, conf)
+end
+
+
+local function gen_sign(random, expires, key)
+    local sha256 = resty_sha256:new()
+
+    local sign = {
+      random = random,
+      expires = expires,
+      key = key,
+    }
+
+    sha256:update(core.json.encode(sign))
+    local digest = sha256:final()
+
+    return ngx_encode_base64(digest)
+end
+
+
+local function gen_csrf_token(conf)
+    local random = math.random();
+    local sign = gen_sign(random, conf.expires, conf.key)
+
+    local token = {
+      random = random,
+      expires = conf.expires,
+      sign = sign,
+    }
+
+    local cookie = ngx_encode_base64(core.json.encode(token))
+    return cookie
+end
+
+
+local function check_csrf_token(conf, ctx, token)
+    local _token = ngx_decode_base64(token)
+    local _token_table, err = core.json.decode(_token)
+    if err then
+      core.log.error("decode token error: ", err)
+      return false
+    end
+
+    local random = _token_table["random"]
+    if not random then
+      core.log.warn("no random in token")
+      return false
+    end
+
+    local expires = _token_table["expires"]
+    if not expires then
+      core.log.warn("no expires in token")
+      return false
+    end
+
+    local sign = gen_sign(random, expires, conf.key)
+    if _token_table["sign"] ~= sign then
+      return false
+    end
+
+    return true
+end
+
+
+function _M.access(conf, ctx)
+    local method = ctx.var.request_method
+    if method == 'GET' then
+      return
+    end
+
+    local token = core.request.header(ctx, conf.name)
+    if not token then
+      return 401, {error_msg = "no csrf token in request header"}
+    end
+
+    local cookie, err = ck:new()
+    if not cookie then
+      return nil, err
+    end
+
+    local field_cookie, err = cookie:get(conf.name)
+    if not field_cookie then
+      return 401, {error_msg = "no csrf cookie"}
+    end
+
+    if err then
+      core.log.error(err)
+      return 400, {error_msg = "read csrf cookie failed"}
+    end
+
+    if token ~= field_cookie then
+      return 401, {error_msg = "csrf token mismatch"}
+    end
+
+    local result = check_csrf_token(conf, ctx, token)
+    if not result then
+      return 401, {error_msg = "Failed to verify the csrf token signature"}
+    end
+end
+
+
+function _M.header_filter(conf, ctx)
+    local method = ctx.var.request_method
+    if method == 'GET' then
+      local csrf_token = gen_csrf_token(conf)
+      core.response.add_header("Set-Cookie", {conf.name .. "=" .. csrf_token
+                                              .. ";path=/;Expires="
+                                              .. cookie_time(timer() + conf.expires)})
+    end
+end
+
+return _M

conf/config-default.yaml

@@ -330,6 +330,7 @@ plugins:                          # plugin list (sorted by priority)
   - serverless-pre-function        # priority: 10000
   - batch-requests                 # priority: 4010
   - cors                           # priority: 4000
+  - csrf                           # priority: 3500
   - ip-restriction                 # priority: 3000
   - ua-restriction                 # priority: 2999
   - referer-restriction            # priority: 2990

docs/en/latest/config.json

@@ -78,7 +78,8 @@
             "plugins/ip-restriction",
             "plugins/ua-restriction",
             "plugins/referer-restriction",
-            "plugins/consumer-restriction"
+            "plugins/consumer-restriction",
+            "plugins/csrf"
           ]
         },
         {

docs/en/latest/plugins/csrf.md

@@ -0,0 +1,127 @@
+---
+title: csrf
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Summary
+
+- [**Description**](#description)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+## Description
+
+The `CSRF` plugin based on the `Double Submit Cookie` way, protect your API from CSRF attacks.
+
+## Attributes
+
+| Name             | Type    | Requirement | Default | Valid | Description                                                  |
+| ---------------- | ------- | ----------- | ------- | ----- | ------------------------------------------------------------ |
+|   name   |  string |    false    | `apisix_csrf_token`  |    | The name of the token in the generated cookie. |
+| expires |  number | false | `7200` | | Expiration time(s) of csrf cookie. |
+| key | string | true |  |  | The secret key used to encrypt the cookie. |
+
+## How To Enable
+
+1. Create the route and enable the plugin.
+
+```
+curl -i http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X POST -d '
+{
+  "uri": "/hello",
+  "plugins": {
+    "csrf": {
+      "key": "edd1c9f034335f136f87ad84b625c8f1"
+    }
+  },
+  "upstream": {
+    "type": "roundrobin",
+    "nodes": {
+      "127.0.0.1:9001": 1
+    }
+  }
+}'
+```
+
+The route is then protected, and if you access it using methods other than `GET`, you will see that the request was blocked and receive a 401 status code back.
+
+2. Using `GET` requests `/hello`, a cookie with an encrypted token is received in the response. Token name is the `name` field set in the plugin configuration, if not set, the default value is `apisix_csrf_token`.
+
+3. In subsequent non-GET requests to this route, you need to read the encrypted token from the cookie and append the token to the `request header`, setting the field name to the `name` in the plugin configuration.
+
+## Test Plugin
+
+The above configuration created a `/hello` route and enabled the csrf plugin, now direct access to the route using a non-GET method will return an error:
+
+```
+curl -i http://127.0.0.1:9080/hello -X POST
+```
+
+```
+HTTP/1.1 401 Unauthorized
+Date: Mon, 13 Dec 2021 07:23:23 GMT
+Content-Type: text/plain; charset=utf-8
+Transfer-Encoding: chunked
+Connection: keep-alive
+Server: APISIX
+```
+
+When accessed with a GET request, the correct return and a cookie with an encrypted token are obtained:
+
+```
+curl -i http://127.0.0.1:9080/hello
+```
+
+```
+HTTP/1.1 200 OK
+Content-Type: text/plain; charset=utf-8
+Content-Length: 13
+Connection: keep-alive
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+permissions-policy: interest-cohort=()
+date: Mon, 13 Dec 2021 07:33:55 GMT
+Server: APISIX
+Set-Cookie: apisix_csrf_token=eyJyYW5kb20iOjAuNjg4OTcyMzA4ODM1NDMsImV4cGlyZXMiOjcyMDAsInNpZ24iOiJcL09uZEF4WUZDZGYwSnBiNDlKREtnbzVoYkJjbzhkS0JRZXVDQm44MG9ldz0ifQ==;path=/;Expires=Mon, 13-Dec-21 09:33:55 GMT
+```
+
+The token needs to be read from the cookie and carried in the request header in subsequent non-GET requests. You also need to make sure that you carry the cookie.
+
+## Disable Plugin
+
+Send a request to update the route to disable the plugin:
+
+```
+curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
+{
+  "uri": "/hello",
+  "upstream": {
+    "type": "roundrobin",
+    "nodes": {
+      "127.0.0.1:1980": 1
+    }
+  }
+}'
+```
+
+CSRF plugin have been disabled.

docs/zh/latest/config.json

@@ -77,7 +77,8 @@
             "plugins/ip-restriction",
             "plugins/ua-restriction",
             "plugins/referer-restriction",
-            "plugins/consumer-restriction"
+            "plugins/consumer-restriction",
+            "plugins/csrf"
           ]
         },
         {