Bugzilla – Bug 9584
CSRF error message need some layout tweaks to not discourage users.
Last modified: 2009-10-05 14:26:17 UTC
Our CSRF protection is checking for referer in the HTTP headers. An increasing number of products ("Internet security suites", FF add-ons etc.) offer to remove that header as part of the privacy protection. In this case the user is faced with an ugly error message when trying to set some preference. (o-tone tester: "I get the world's ugliest, the worst error message I've ever seen. It's hilarious. It instantly tells you not to read it.") The descriptions are way too technical for users to understand. In the best case they will just turn it off because they want to get SC working. We should - consider disabling CSRF protection by default - re-design the error page, as it's daunting
Created attachment 4059 [details] example error message Languages with accented characters are even worse, as the characters are broken...
Could you dissable by default if the client is the same host as the server or on the local network?
I'd assume most "threats" come from the localhost: a mail with a dodgy link in it, sent to you.
Andy agrees it should be disabled by default
change 23333 - CSRF protection is now disabled by default. Still need to improve the error page's layout.
change 26175 - in the CSRF error page only show url without the parameters. It's too confusing.
I think it would be better to go back to defaulting to Medium protection and add some code in the default skin to detect Referer problems and inform the user than to disable the protection for all new users -- much as many web apps use code to detect pop-up blockers. I'm grateful, though, that you're still giving users the option to turn on the protection. I agree the error message is hideous (and I wrote it). Beyond fixing the awful \" junk, it would be nice if this page linked to resources discussing CSRF, and maybe some of the software that Logitech support has run into that cause problems. And linking to pages that others maintain (Wikipedia?) means less translation work/cost for Logitech. :-)
This bug has been marked as fixed in the 7.4.0 release version of SqueezeBox Server! * SqueezeCenter: 28672 * Squeezebox 2 and 3: 130 * Transporter: 80 * Receiver: 65 * Boom: 50 * Controller: 7790 * Radio: 7790 Please see the Release Notes for all the details: http://wiki.slimdevices.com/index.php/Release_Notes If you haven't already, please download and install the new version from http://www.logitechsqueezebox.com/support/download-squeezebox-server.html If you are still experiencing this problem, feel free to reopen the bug with your new comments and we'll have another look.