CSRF protection for web forms

app/Global.scala

@@ -1,15 +1,10 @@
 import scala.concurrent.Future
-
 import play.api.Application
 import play.api.GlobalSettings
 import play.api.Logger
 import play.api.Mode
 import play.api.Play
-import play.api.mvc.Handler
-import play.api.mvc.RequestHeader
-import play.api.mvc.Result
-import play.api.mvc.Results
-
+import play.api.mvc._
 import collins.callbacks.Callback
 import collins.controllers.ApiResponse
 import collins.db.DB
@@ -30,8 +25,9 @@ import collins.util.config.Registry
 import collins.util.security.AuthenticationAccessor
 import collins.util.security.AuthenticationProvider
 import collins.util.security.AuthenticationProviderConfig
+import play.filters.csrf._
 
-object Global extends GlobalSettings with AuthenticationAccessor with CryptoAccessor {
+object Global extends WithFilters(new OptionalCSRFFilter(CSRFFilter())) with GlobalSettings with AuthenticationAccessor with CryptoAccessor {
   private[this] val logger = Logger.logger
 
   override def beforeStart(app: Application) {
@@ -78,11 +74,12 @@ object Global extends GlobalSettings with AuthenticationAccessor with CryptoAcce
 
   override def onError(request: RequestHeader, ex: Throwable): Future[Result] = {
     logger.warn("Unhandled exception", ex)
-    val debugOutput = Play.maybeApplication.map {
-      case app if app.mode == Mode.Dev => true
-      case app if app.mode == Mode.Test => true
+    val debugOutput = Play.maybeApplication match {
+      case Some(Mode.Dev) => true
+      case Some(Mode.Test) => true
       case _ => false
-    }.getOrElse(true)
+    }
+
     val status = Results.InternalServerError
     val err = if (debugOutput) Some(ex) else None
     OutputType(request) match {
@@ -154,3 +151,16 @@ object Global extends GlobalSettings with AuthenticationAccessor with CryptoAcce
     authen
   }
 }
+
+class OptionalCSRFFilter(filter: CSRFFilter) extends EssentialFilter {
+
+  override def apply(nextFilter: EssentialAction): EssentialAction = new EssentialAction {
+
+    //thanks to dominik dorn for the writeup on exlusion filters
+    //more here: https://dominikdorn.com/2014/07/playframework-2-3-global-csrf-protection-disable-csrf-selectively/
+    override def apply(rh: RequestHeader) = {
+      val chainedFilter = filter.apply(nextFilter)
+      if (rh.path.startsWith("/api/")) nextFilter(rh) else chainedFilter(rh)
+    }
+  }
+}

app/views/login.scala.html

@@ -53,6 +53,7 @@ <h1>Login <small>Enter your credentials.</small></h1>
           @loginForm("location").value.map { value =>
           <input type="hidden" name="location" value="@value">
           }
+          @helper.CSRF.formField
         }
       </div>
     </div>

app/views/main.scala.html

@@ -89,6 +89,7 @@
             <input class="input-medium form-control" type="text" name="username" placeholder="Username">
             <input class="input-medium form-control" type="password" name="password" placeholder="Password">
             <button class="btn btn-default" type="submit">Sign in</button>
+	    @helper.CSRF.formField
           </form>
         </div>
       </div>

app/views/resources/create.scala.html

@@ -54,6 +54,7 @@ <h1>Create <small>Make a new @atype.label.</small></h1>
               <button type="submit" class="btn btn-primary">Create @atype.label</button>
             </div>
           </div>
+          @helper.CSRF.formField
         </form>
       </div>
     </div>

build.sbt

@@ -56,4 +56,4 @@ libraryDependencies ++= Seq(
   "org.webjars" % "jquery" % "2.1.4",
   "com.hazelcast" % "hazelcast" % "3.5.2",
   ws
-)
+) :+ filters

project/plugins.sbt

@@ -5,7 +5,7 @@ resolvers ++= Seq(
     "Sontype Releases" at "https://oss.sonatype.org/content/repositories/releases/"
 )
 
-addSbtPlugin("com.typesafe.play" % "sbt-plugin" % Option(System.getProperty("play.version")).getOrElse("2.3.9"))
+addSbtPlugin("com.typesafe.play" % "sbt-plugin" % Option(System.getProperty("play.version")).getOrElse("2.3.10"))
 
 addSbtPlugin("org.scalastyle" %% "scalastyle-sbt-plugin" % "0.6.0")