Skip to content

CSRF_IP_ACCESS_FIX.md

Latest commit

 

History

History
216 lines (150 loc) · 4.89 KB

CSRF_IP_ACCESS_FIX.md

File metadata and controls

216 lines (150 loc) · 4.89 KB
Raw

CSRF Cookie Fix for Remote IP Access

Problem Summary

✅ Works: Accessing via http://localhost:8080 - CSRF cookies created correctly
❌ Fails: Accessing via http://192.168.1.100:8080 - CSRF cookies NOT created

Root Cause

The WTF_CSRF_SSL_STRICT=true setting (default) blocks cookie creation for HTTP connections to non-localhost addresses. This is a security feature that prevents CSRF tokens from being sent over insecure connections.

Quick Fix

Option 1: Automated Script (Recommended)

Linux/Mac:

bash scripts/fix_csrf_ip_access.sh

Windows:

scripts\fix_csrf_ip_access.bat

The script will:

  1. Update your .env file with correct settings
  2. Restart the application
  3. Verify the configuration

Option 2: Manual Configuration

Edit your .env file and add/update:

WTF_CSRF_SSL_STRICT=false
SESSION_COOKIE_SECURE=false
CSRF_COOKIE_SECURE=false

Then restart:

docker-compose restart app

What These Settings Do

Setting Value Purpose
WTF_CSRF_SSL_STRICT false Allows CSRF tokens over HTTP (needed for IP access)
SESSION_COOKIE_SECURE false Allows session cookies over HTTP
CSRF_COOKIE_SECURE false Allows CSRF cookies over HTTP

Verification

1. Check Environment Variables

docker-compose exec app env | grep -E "(WTF_CSRF|SESSION_COOKIE|CSRF_COOKIE)"

Expected output:

WTF_CSRF_SSL_STRICT=false
SESSION_COOKIE_SECURE=false
CSRF_COOKIE_SECURE=false

2. Test Cookie Creation

  1. Open your browser
  2. Navigate to http://YOUR_IP:8080
  3. Open DevTools (F12)
  4. Go to Application → Cookies
  5. Verify these cookies exist:
    • session - Your session cookie
    • XSRF-TOKEN - The CSRF token

3. Test CSRF Endpoint

# Via localhost (should work)
curl -v http://localhost:8080/auth/csrf-token

# Via IP (should now also work)
curl -v http://192.168.1.100:8080/auth/csrf-token

Look for Set-Cookie headers in both responses.

Security Considerations

⚠️ Important Security Notes

These settings are suitable for:

  • ✅ Development environments
  • ✅ Testing on local networks
  • ✅ Private/trusted networks (VPN, home network)

NOT suitable for:

  • ❌ Public internet access without HTTPS
  • ❌ Production environments with sensitive data
  • ❌ Untrusted networks

Production Configuration

For production deployments, always use HTTPS and set:

WTF_CSRF_SSL_STRICT=true
SESSION_COOKIE_SECURE=true
CSRF_COOKIE_SECURE=true

Alternative Solutions

Solution 1: Use a Domain Name

Add to your hosts file instead of using IP:

Linux/Mac (/etc/hosts):

192.168.1.100 timetracker.local

Windows (C:\Windows\System32\drivers\etc\hosts):

192.168.1.100 timetracker.local

Then access via: http://timetracker.local:8080

Solution 2: Set Up HTTPS

For production-like testing with HTTPS:

  1. Generate self-signed certificate:
openssl req -x509 -newkey rsa:4096 -nodes \
  -keyout key.pem -out cert.pem -days 365 \
  -subj "/CN=192.168.1.100"
  1. Update docker-compose to use HTTPS
  2. Set all security flags to true

Troubleshooting

Still not working?

  1. Verify settings are loaded:

    docker-compose exec app env | grep WTF_CSRF_SSL_STRICT

  2. Check logs:

    docker-compose logs app | grep -i csrf

  3. Try a fresh restart:

    docker-compose down
docker-compose up -d

  4. Clear browser cookies:

    • DevTools → Application → Cookies → Delete all for this site

  5. Test in incognito/private window:

    • Rules out browser extension issues

Different browsers behave differently?

  • Chrome/Edge: Usually most permissive
  • Firefox: Stricter cookie policies
  • Safari: Strictest, especially with tracking prevention

Try disabling enhanced tracking protection or privacy features temporarily for testing.

Related Documentation

Summary

The Fix: Set WTF_CSRF_SSL_STRICT=false for HTTP access via IP addresses.

Why It Works: This allows Flask-WTF to create and validate CSRF cookies over HTTP connections to non-localhost addresses.

When to Use: Development, testing, and trusted private networks only. Always use HTTPS with strict settings in production.

Quick Command Reference:

# Apply fix (automated)
bash scripts/fix_csrf_ip_access.sh

# Verify configuration
docker-compose exec app env | grep -E "WTF_CSRF|SESSION_COOKIE|CSRF_COOKIE"

# Restart application
docker-compose restart app

# Check logs
docker-compose logs app | tail -50

Last Updated: October 2024
Applies To: TimeTracker v1.0+