[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135304#comment-18135304
]
Jürgen Weber commented on JSPWIKI-1306:
---------------------------------------
Hola Arturo, the whitelist according to my patch is an entry in
jspwiki-custom.properties, e.g.
jspwiki.CsrfProtectionFilter.servletWhitelist=/wikibag
If not set there is no whitelist at all. So an whitelist entry has to
explicitly done by the system admin.
For the wikibag servlet I use container security, so before the
CsrfProtectionFilter Chrome shows the Wiki Login.
I have added the org.apache.catalina.filters.RequestDumperFilter and append its
log which shows the headers.
Why don't you give the WikiBag a try?
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
