taskSavannah Administration - Tasks: task #6107, Submission of Request Rodeo

 
 

task #6107: Submission of Request Rodeo

Submitter:  Justus Winter <teythoon>
Submitted:  Wed 15 Nov 2006 05:58:39 PM UTC
   
 
Should Start On:  Wed 15 Nov 2006 12:00:00 AM UTC Should be Finished on:  Sat 25 Nov 2006 12:00:00 AM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  sp Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 29 Nov 2006 07:55:14 PM UTC, comment #1: 

Hi Justus,
 
I'm evaluating the project you submitted for approval in Savannah. While doing so I have noticed a problem which is described below.

If some of your files cannot carry license and copyright notices (e.g. binary files), then you can add a README file in the same directory containing the copyright and license notices. Check http://www.gnu.org/prep/maintain/html_node/Copyright-Notices.html for further information.

However, I do trust you to fix this issue before uploading any source code on Savannah.

So I have approved your project.  You will receive an automated e-mail containing detailed information about the approval.

Regards,

Stephan

Stephan Peijnik <sp>
Wed 15 Nov 2006 05:58:39 PM UTC, original submission:  

A new project has been registered at Savannah
This project account will remain inactive until a site admin approves or discards the registration.


Registration Administration


While this item will be useful to track the registration process, approving or discarding the registration must be done using the specific "Group Administration" page, accessible only to site administrators, effectively logged as site administrators (superuser):

  <https://savannah.nongnu.org/siteadmin/groupedit.php?group_id=8921>


Registration Details


  • Name: Request Rodeo
  • System Name:  requestrodeo
  • Type: non-GNU software &amp; documentation
  • License: GNU General Public License V2 or later





Description: RequestRodeo is a novel concept to protect users of web applications against Session Riding  (also known as Cross Site Request Forgery).

RequestRodeo is a http proxy written in Python using the Twisted framework, OpenSSL and SQLite. It protects its user(s) against an relatively unknown attack vector, Session Riding. A short introduction to session riding can be found at Wikipedia[1]. RequestRodeo is to our best knowledge the only project of its kind.

Up to now, there are just two people working on RequestRodeo, me and Martin Johns[2], who did most of the research for this project. He gave a talks on Session Riding and the RequestRodeo in 2006 at the OWASP Europe[3], and will talk about it at the PacSec[4] conference and the Chaos Communication Congress[5].

A recent svn snapshot can be found at [6] and a scientific paper describing Session Riding and our RequestRodeo proxy can be found at [7].

There are some benefits gained from using the proxy approach rather than implementing the protection directly in the web browser, such as browser independence and ease of deployment (our proxy works with all major browsers), but there are several drawbacks (we need to track the users movements to construct a reliable = not browser dependent referrer and we need to act as an http to https bridge in order to support https).

Our long term plan is to write an extension for Mozilla Seamonkey and Mozilla Firefox. Work on this has just begun.

We are in need of a development and deployment platform and love to use Savannah for this purpose.

1: http://en.wikipedia.org/wiki/Session_riding
2: http://www.informatik.uni-hamburg.de/SVS/personnel/martin/index.php
3: http://www.owasp.org/index.php/Main_Page
4: http://pacsec.jp/
5: http://events.ccc.de/congress/2006/Home
6: http://winter.gotdns.org/pub/
7: http://www.informatik.uni-hamburg.de/SVS/papers/2006_owasp_RequestRodeo.pdf


Other Software Required: Python, OpenSSL, PyOpenSSL, SQLite3, pysqlite2, twisted


Justus Winter <teythoon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sp (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2006-11-29 sp StatusNone Done
        Assigned toNone sp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code