fix: harden CSRF protections

CHANGELOG.md

@@ -1,3 +1,9 @@
+## Unreleased
+
+### Security Fixes
+
+1. [#6186](https://github.com/influxdata/chronograf/pull/6186): Hardened CSRF protections on Data Explorer and unsafe query endpoints.
+
 ## v1.11.0 [2026-02-19]
 
 ⚠️ Removed support for Linux i386, armhf, armel and static build. Removed support for Darwin arm64.

oauth2/cookies.go

@@ -18,12 +18,13 @@ type cookie struct {
 	Name       string        // Name is the name of the cookie stored on the browser
 	Lifespan   time.Duration // Lifespan is the expiration date of the cookie. 0 means session cookie
 	Inactivity time.Duration // Inactivity is the length of time a token is valid if there is no activity
+	Secure     bool          // Secure controls whether the cookie is sent only over HTTPS
 	Now        func() time.Time
 	Tokens     Tokenizer
 }
 
 // NewCookieJWT creates an Authenticator that uses cookies for auth
-func NewCookieJWT(secret string, lifespan, inactivity time.Duration) Authenticator {
+func NewCookieJWT(secret string, lifespan, inactivity time.Duration, secure bool) Authenticator {
 	// Server interprets a token duration longer than the cookie lifespan as
 	// a token that was issued by a server with a longer auth-duration and is
 	// thus invalid, as a security precaution. So, inactivity must be set to
@@ -35,6 +36,7 @@ func NewCookieJWT(secret string, lifespan, inactivity time.Duration) Authenticat
 		Name:       DefaultCookieName,
 		Lifespan:   lifespan,
 		Inactivity: inactivity,
+		Secure:     secure,
 		Now:        DefaultNowTime,
 		Tokens: &JWT{
 			Secret: secret,
@@ -107,6 +109,8 @@ func (c *cookie) setCookie(w http.ResponseWriter, value string, exp time.Time) {
 		Value:    value,
 		HttpOnly: true,
 		Path:     "/",
+		SameSite: http.SameSiteStrictMode,
+		Secure:   c.Secure,
 	}
 
 	// Only set a cookie to be persistent (endure beyond the browser session)
@@ -126,6 +130,8 @@ func (c *cookie) Expire(w http.ResponseWriter) {
 		HttpOnly: true,
 		Path:     "/",
 		Expires:  c.Now().Add(-1 * time.Hour),
+		SameSite: http.SameSiteStrictMode,
+		Secure:   c.Secure,
 	}
 
 	http.SetCookie(w, &cookie)

oauth2/cookies_test.go

@@ -162,26 +162,35 @@ func TestCookieValidate(t *testing.T) {
 }
 
 func TestNewCookieJWT(t *testing.T) {
-	auth := NewCookieJWT("secret", 2*time.Second, defaultInactivityDuration)
+	auth := NewCookieJWT("secret", 2*time.Second, defaultInactivityDuration, false)
 	if cookie, ok := auth.(*cookie); !ok {
 		t.Errorf("NewCookieJWT() did not create cookie Authenticator")
 	} else if cookie.Inactivity != time.Second {
 		t.Errorf("NewCookieJWT() inactivity was not two seconds: %s", cookie.Inactivity)
 	}
 
-	auth = NewCookieJWT("secret", time.Hour, defaultInactivityDuration)
+	auth = NewCookieJWT("secret", time.Hour, defaultInactivityDuration, false)
 	if cookie, ok := auth.(*cookie); !ok {
 		t.Errorf("NewCookieJWT() did not create cookie Authenticator")
 	} else if cookie.Inactivity != defaultInactivityDuration {
 		t.Errorf("NewCookieJWT() inactivity was not five minutes: %s", cookie.Inactivity)
 	}
 
-	auth = NewCookieJWT("secret", 0, defaultInactivityDuration)
+	auth = NewCookieJWT("secret", 0, defaultInactivityDuration, false)
 	if cookie, ok := auth.(*cookie); !ok {
 		t.Errorf("NewCookieJWT() did not create cookie Authenticator")
 	} else if cookie.Inactivity != defaultInactivityDuration {
 		t.Errorf("NewCookieJWT() inactivity was not five minutes: %s", cookie.Inactivity)
 	}
+
+	auth = NewCookieJWT("secret", 30*time.Minute, defaultInactivityDuration, true)
+	if cookie, ok := auth.(*cookie); !ok {
+		t.Errorf("NewCookieJWT() did not create cookie Authenticator")
+	} else if cookie.Inactivity != defaultInactivityDuration {
+		t.Errorf("NewCookieJWT() inactivity was not five minutes: %s", cookie.Inactivity)
+	} else if !cookie.Secure {
+		t.Errorf("NewCookieJWT() secure was false, expected true")
+	}
 }
 
 func TestCookieExtend(t *testing.T) {

server/middle_test.go

@@ -194,3 +194,174 @@ func TestRouteMatchesPrincipal(t *testing.T) {
 		})
 	}
 }
+
+func TestRequireRequestedWithXMLHttpRequest(t *testing.T) {
+	logger := log.New(log.DebugLevel)
+	protected := RequireRequestedWithXMLHttpRequest(
+		logger,
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusNoContent)
+		}),
+	)
+
+	tests := []struct {
+		name     string
+		header   string
+		expected int
+	}{
+		{name: "missing header", expected: http.StatusForbidden},
+		{name: "invalid header", header: "fetch", expected: http.StatusForbidden},
+		{
+			name:     "valid header",
+			header:   "XMLHttpRequest",
+			expected: http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPost, "http://chronograf.test/query", nil)
+			if tt.header != "" {
+				req.Header.Set("X-Requested-With", tt.header)
+			}
+
+			rec := httptest.NewRecorder()
+			protected.ServeHTTP(rec, req)
+
+			if rec.Code != tt.expected {
+				t.Fatalf("status=%d, want=%d", rec.Code, tt.expected)
+			}
+		})
+	}
+}
+
+func TestSecurityHeaders(t *testing.T) {
+	protected := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "http://chronograf.test/", nil)
+	rec := httptest.NewRecorder()
+
+	protected.ServeHTTP(rec, req)
+
+	if got := rec.Header().Get("X-Frame-Options"); got != "SAMEORIGIN" {
+		t.Fatalf("X-Frame-Options=%q, want %q", got, "SAMEORIGIN")
+	}
+
+	if got := rec.Header().Get("Cross-Origin-Resource-Policy"); got != "same-origin" {
+		t.Fatalf("Cross-Origin-Resource-Policy=%q, want %q", got, "same-origin")
+	}
+}
+
+func TestRequireSameOriginForSessionAuth(t *testing.T) {
+	logger := log.New(log.DebugLevel)
+	protected := RequireSameOriginForSessionAuth(
+		logger,
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusNoContent)
+		}),
+	)
+
+	tests := []struct {
+		name       string
+		method     string
+		host       string
+		origin     string
+		referer    string
+		forwarded  string
+		hasSession bool
+		expected   int
+	}{
+		{
+			name:       "unsafe with matching origin is allowed",
+			method:     http.MethodPost,
+			host:       "chronograf.test",
+			origin:     "http://chronograf.test",
+			hasSession: true,
+			expected:   http.StatusNoContent,
+		},
+		{
+			name:       "unsafe with mismatched origin is blocked",
+			method:     http.MethodPost,
+			host:       "chronograf.test",
+			origin:     "https://attacker.test",
+			hasSession: true,
+			expected:   http.StatusForbidden,
+		},
+		{
+			name:       "unsafe with matching referer is allowed",
+			method:     http.MethodPatch,
+			host:       "chronograf.test",
+			referer:    "http://chronograf.test/path",
+			hasSession: true,
+			expected:   http.StatusNoContent,
+		},
+		{
+			name:       "unsafe with scheme mismatch is blocked",
+			method:     http.MethodPost,
+			host:       "chronograf.test",
+			origin:     "https://chronograf.test",
+			hasSession: true,
+			expected:   http.StatusForbidden,
+		},
+		{
+			name:       "unsafe with forwarded proto https allows https origin",
+			method:     http.MethodPost,
+			host:       "chronograf.test",
+			origin:     "https://chronograf.test",
+			forwarded:  "https",
+			hasSession: true,
+			expected:   http.StatusNoContent,
+		},
+		{
+			name:       "unsafe missing origin and referer is blocked with session",
+			method:     http.MethodDelete,
+			host:       "chronograf.test",
+			hasSession: true,
+			expected:   http.StatusForbidden,
+		},
+		{
+			name:       "unsafe without session bypasses origin guard",
+			method:     http.MethodPost,
+			host:       "chronograf.test",
+			origin:     "https://attacker.test",
+			hasSession: false,
+			expected:   http.StatusNoContent,
+		},
+		{
+			name:       "safe method bypasses origin guard",
+			method:     http.MethodGet,
+			host:       "chronograf.test",
+			origin:     "https://attacker.test",
+			hasSession: true,
+			expected:   http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, "http://chronograf.test/test", nil)
+			req.Host = tt.host
+			if tt.origin != "" {
+				req.Header.Set("Origin", tt.origin)
+			}
+			if tt.referer != "" {
+				req.Header.Set("Referer", tt.referer)
+			}
+			if tt.forwarded != "" {
+				req.Header.Set("X-Forwarded-Proto", tt.forwarded)
+			}
+			if tt.hasSession {
+				req.AddCookie(&http.Cookie{Name: oauth2.DefaultCookieName, Value: "token"})
+			}
+
+			rec := httptest.NewRecorder()
+			protected.ServeHTTP(rec, req)
+
+			if rec.Code != tt.expected {
+				t.Fatalf("status=%d, want=%d", rec.Code, tt.expected)
+			}
+		})
+	}
+}

server/mux.go

@@ -198,13 +198,30 @@ func NewMux(opts MuxOpts, service Service) http.Handler {
 	router.GET("/chronograf/v1/flux/suggestions/:name", EnsureViewer(service.FluxSuggestion))
 
 	// Source Proxy to Influx; Has gzip compression around the handler
-	influx := gziphandler.GzipHandler(http.HandlerFunc(EnsureReader(service.Influx)))
+	influx := RequireRequestedWithXMLHttpRequest(
+		opts.Logger,
+		gziphandler.GzipHandler(http.HandlerFunc(EnsureReader(service.Influx))),
+	)
 	router.Handler("POST", "/chronograf/v1/sources/:id/proxy", influx)
 
 	// Source Proxy to Influx's flux endpoint; compression because the responses from
 	// flux could be large.
-	router.Handler("POST", "/chronograf/v1/sources/:id/proxy/flux", EnsureReader(service.ProxyFlux))
-	router.Handler("GET", "/chronograf/v1/sources/:id/proxy/flux", EnsureReader(service.ProxyFlux))
+	router.Handler(
+		"POST",
+		"/chronograf/v1/sources/:id/proxy/flux",
+		RequireRequestedWithXMLHttpRequest(
+			opts.Logger,
+			http.HandlerFunc(EnsureReader(service.ProxyFlux)),
+		),
+	)
+	router.Handler(
+		"GET",
+		"/chronograf/v1/sources/:id/proxy/flux",
+		RequireRequestedWithXMLHttpRequest(
+			opts.Logger,
+			http.HandlerFunc(EnsureReader(service.ProxyFlux)),
+		),
+	)
 
 	// Write proxies line protocol write requests to InfluxDB
 	router.POST("/chronograf/v1/sources/:id/write", EnsureViewer(service.Write))
@@ -215,7 +232,14 @@ func NewMux(opts MuxOpts, service Service) http.Handler {
 	//
 	// Admins should ensure that the InfluxDB source as the proper permissions
 	// intended for Chronograf Users with the Viewer Role type.
-	router.POST("/chronograf/v1/sources/:id/queries", EnsureReader(service.Queries))
+	router.Handler(
+		"POST",
+		"/chronograf/v1/sources/:id/queries",
+		RequireRequestedWithXMLHttpRequest(
+			opts.Logger,
+			http.HandlerFunc(EnsureReader(service.Queries)),
+		),
+	)
 
 	// Annotations are user-defined events associated with this source
 	router.GET("/chronograf/v1/sources/:id/annotations", EnsureReader(service.Annotations))
@@ -393,6 +417,8 @@ func NewMux(opts MuxOpts, service Service) http.Handler {
 	} else {
 		out = router
 	}
+	out = RequireSameOriginForSessionAuth(opts.Logger, out)
+	out = SecurityHeaders(out)
 	out = Logger(opts.Logger, FlushingHandler(out))
 
 	return out

server/requested_with.go

@@ -0,0 +1,34 @@
+package server
+
+import (
+	"net/http"
+
+	"github.com/influxdata/chronograf"
+)
+
+const (
+	requestedWithHeaderName   = "X-Requested-With"
+	xmlHttpRequestHeaderValue = "XMLHttpRequest"
+)
+
+// RequireRequestedWithXMLHttpRequest rejects requests that do not include
+// X-Requested-With: XMLHttpRequest.
+func RequireRequestedWithXMLHttpRequest(
+	logger chronograf.Logger,
+	next http.Handler,
+) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get(requestedWithHeaderName) != xmlHttpRequestHeaderValue {
+			logger.
+				WithField("component", "request_header_guard").
+				WithField("remote_addr", r.RemoteAddr).
+				WithField("method", r.Method).
+				WithField("url", r.URL).
+				Error("Missing or invalid X-Requested-With header")
+			Error(w, http.StatusForbidden, "missing required X-Requested-With header", logger)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}