Frank/Escapepage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSRF protection, login throttling, and invite-code rate limiting

Browse Source 
The admin panel already checked CSRF tokens on destructive actions,
but the player-facing raw HTML forms (create/join/leave/start
session, toggle ready, lobby chat, feedback) had none - cookie
SameSite=Lax blunts classic cross-site auto-submit attacks but isn't
a substitute for real tokens. Adds matching csrf_token()/
isCsrfTokenValid() checks to all of them.

Also adds login_throttling (5 attempts/15 min) to stop unlimited
password guessing, and a per-user rate limiter (10/min) on the
invite-code join endpoint, since invite codes are only 32-bit and
had no protection against brute-forcing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Frank
2026-08-10 21:41:47 +02:00
co-authored by Claude Sonnet 5
parent 335697e520
commit 2913b8d2a2
8 changed files with 67 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/game/dashboard.html.twig
+5
View File
@@ -17,6 +17,7 @@
<div class="card-body">
{% if availableGames is not empty %}
<form method="post">
<input type="hidden" name="_token" value="{{ csrf_token('create_session') }}">
<select name="game_id" class="form-select mb-3">
{% for game in availableGames %}
<option value="{{ game.id }}">
@@ -40,6 +41,7 @@
<div class="card-header bg-secondary text-white">Join Session</div>
<div class="card-body">
<form method="post" class="d-flex gap-2">
<input type="hidden" name="_token" value="{{ csrf_token('join_session') }}">
<input type="text" name="invite_code" class="form-control" placeholder="Enter Invite Code" required>
<button type="submit" name="join_session" class="btn btn-primary text-nowrap">Join Session</button>
</form>
@@ -81,6 +83,7 @@
<code>{{ inviteCode }}</code>
{% else %}
<form method="post" class="d-inline">
<input type="hidden" name="_token" value="{{ csrf_token('create_invite_' ~ session.id) }}">
<input type="hidden" name="session_id" value="{{ session.id }}">
<button type="submit" name="create_invite" class="btn btn-sm btn-outline-secondary">Generate Invite</button>
</form>
@@ -91,12 +94,14 @@
{% if session.status.value == 'created' %}
{% if session.players|length >= session.game.numberOfPlayers %}
<form method="post" class="d-inline">
<input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
<input type="hidden" name="session_id" value="{{ session.id }}">
<button type="submit" name="start_session" class="btn btn-sm btn-success">Start Session</button>
</form>
{% endif %}
{% if session.timer == 0 %}
<form method="post" class="d-inline">
<input type="hidden" name="_token" value="{{ csrf_token('leave_session_' ~ session.id) }}">
<input type="hidden" name="session_id" value="{{ session.id }}">
<button type="submit" name="leave_session" class="btn btn-sm btn-outline-danger" onclick="return confirm('Are you sure you want to leave this session?')">Leave Session</button>
</form>
templates/game/lobby.html.twig
+2
View File
@@ -29,6 +29,7 @@
{% if session.players|length >= session.game.numberOfPlayers %}
<form method="post" action="{{ path('game_dashboard') }}" class="mb-3">
<input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
<input type="hidden" name="session_id" value="{{ session.id }}">
<button type="submit" name="start_session" class="btn btn-success">Start Session</button>
</form>
@@ -71,6 +72,7 @@
{% if player %}
<form method="post" class="d-flex gap-2">
<input type="hidden" name="_token" value="{{ csrf_token('send_message_' ~ session.id) }}">
<input type="text" name="content" class="form-control" placeholder="Type a message&hellip;" maxlength="500" required autocomplete="off">
<button type="submit" name="send_message" class="btn btn-primary">Send</button>
</form>
templates/game/lost.html.twig
+1
View File
@@ -78,6 +78,7 @@
<div class="feedback-form mt-4">
<h5>Feedback</h5>
<form method="post">
<input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
<div class="mb-3">
<label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
<input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">
templates/game/waiting.html.twig
+2
View File
@@ -63,6 +63,7 @@
</div>
{% endif %}
<form method="post" class="mt-4">
<input type="hidden" name="_token" value="{{ csrf_token('toggle_ready_' ~ session.id) }}">
<input type="hidden" name="toggle_ready" value="0">
<div class="form-check form-switch mb-3">
<input class="form-check-input" type="checkbox" id="toggle_ready" name="toggle_ready" value="1" onchange="this.form.submit()" {{ isReady ? 'checked' : '' }} {{ not app.user.verified ? 'disabled' : '' }}>
@@ -87,6 +88,7 @@
</div>
<form id="expire-ready-form" method="post" style="display:none">
<input type="hidden" name="_token" value="{{ csrf_token('expire_ready_' ~ session.id) }}">
<input type="hidden" name="expire_ready" value="1">
</form>
templates/game/won.html.twig
+1
View File
@@ -78,6 +78,7 @@
<div class="feedback-form mt-4">
<h5>Feedback</h5>
<form method="post">
<input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
<div class="mb-3">
<label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
<input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">