[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135194#comment-18135194
]
Arturo Bernal commented on JSPWIKI-1306:
----------------------------------------
Hi Jürgen, you are right. A POST from Chrome carries no token, so the filter
would reject it whatever the endpoint is, and my prefill proposal did not avoid
that. Thanks for the explanation of WikiBag.
If the share has to save directly, an exception to the token check is
unavoidable. What can be decided is how narrow it is. I would prefer that over
a general path whitelist:
- one fixed path, not a configurable list of patterns
- the request must be authenticated, and anonymous shares are refused
- the endpoint only creates or appends to a page, and the normal permission
checks apply
Two things I have not verified, so I would test them before settling on a
design: whether Chrome sends Origin or Sec-Fetch-Site on a Web Share Target
POST (that would allow a check on top of the exemption), and whether the
session cookie is sent with that POST given its SameSite setting. If the cookie
is not sent, authentication would need another mechanism.
Is it acceptable for you that the exception applies to one path only, rather
than a general whitelist?
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
