[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135130#comment-18135130
]
Jürgen Weber commented on JSPWIKI-1306:
---------------------------------------
Use case is I want JSPWiki to be a Web Share Target, i.e. receive post requests
from Chrome. And Chrome does not know about JSPWiki's XSRF-TOKEN.
[https://github.com/weberjn/WikiBag]
And I fear, a future REST Api will run into the CsrfProtectionFilter, too.
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
