[WIP] Add logs for bad CSRF token

cmd/web.go

@@ -103,6 +103,8 @@ func createPIDFile(pidPath string) {
 }
 
 func serveInstall(ctx *cli.Context) error {
+	log.Warn("This is a special build for testing CSRF token issues")
+
 	log.Info("Gitea version: %s%s", setting.AppVer, setting.AppBuiltWith)
 	log.Info("App path: %s", setting.AppPath)
 	log.Info("Work path: %s", setting.AppWorkPath)
@@ -145,6 +147,8 @@ func serveInstalled(ctx *cli.Context) error {
 	setting.LoadCommonSettings()
 	setting.MustInstalled()
 
+	log.Warn("This is a special build for testing CSRF token issues")
+
 	log.Info("Gitea version: %s%s", setting.AppVer, setting.AppBuiltWith)
 	log.Info("App path: %s", setting.AppPath)
 	log.Info("Work path: %s", setting.AppWorkPath)

modules/context/csrf.go

@@ -205,7 +205,9 @@ func PrepareCSRFProtector(opt CsrfOptions, ctx *Context) CSRFProtector {
 }
 
 func (c *csrfProtector) validateToken(ctx *Context, token string) {
-	if !ValidCsrfToken(token, c.opt.Secret, c.ID, "POST", time.Now()) {
+	if err := ValidCsrfToken(token, c.opt.Secret, c.ID, "POST", time.Now()); err != nil {
+		log.Error("Failed to validate CSRF token %q (secret=%v..., id=%v): %v", token, c.opt.Secret[:2], c.ID, err)
+		log.Error("CSRF in header: %q, in cookie: %q, in request: %q", ctx.Req.Header.Get(c.opt.Header), ctx.GetSiteCookie(c.opt.Cookie), ctx.Req.FormValue(c.opt.Form))
 		c.DeleteCookie(ctx)
 		if middleware.IsAPIPath(ctx.Req) {
 			// currently, there should be no access to the APIPath with CSRF token. because templates shouldn't use the `/api/` endpoints.

modules/context/xsrf.go

@@ -73,27 +73,30 @@ func ParseCsrfToken(token string) (issueTime time.Time, ok bool) {
 }
 
 // ValidCsrfToken returns true if token is a valid and unexpired token returned by Generate.
-func ValidCsrfToken(token, key, userID, actionID string, now time.Time) bool {
+func ValidCsrfToken(token, key, userID, actionID string, now time.Time) error {
 	issueTime, ok := ParseCsrfToken(token)
 	if !ok {
-		return false
+		return fmt.Errorf("ParseCsrfToken failed for token %q", token)
 	}
 
 	// Check that the token is not expired.
 	if now.Sub(issueTime) >= CsrfTokenTimeout {
-		return false
+		return fmt.Errorf("CSRF token %q is expeired", token)
 	}
 
 	// Check that the token is not from the future.
 	// Allow 1-minute grace period in case the token is being verified on a
 	// machine whose clock is behind the machine that issued the token.
 	if issueTime.After(now.Add(1 * time.Minute)) {
-		return false
+		return fmt.Errorf("CSRF token %q is in future", token)
 	}
 
 	expected := GenerateCsrfToken(key, userID, actionID, issueTime)
 
 	// Check that the token matches the expected value.
 	// Use constant time comparison to avoid timing attacks.
-	return subtle.ConstantTimeCompare([]byte(token), []byte(expected)) == 1
+	if subtle.ConstantTimeCompare([]byte(token), []byte(expected)) != 1 {
+		return fmt.Errorf("CSRF token %q does not match expected value %q", token, expected)
+	}
+	return nil
 }