[
https://issues.apache.org/jira/browse/SLING-10843?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17421439#comment-17421439
]
Cris Rockwell commented on SLING-10843:
---------------------------------------
Maybe there was an issue configuring <URL> allowedUriReferrers configuration
with an app URI. But I don't see the issue configuring <Pattern>
allowedRegexReferrers with the pattern shown in the
[test|https://github.com/apache/sling-org-apache-sling-security/pull/3/files].
It may also be nice to know if such an allowance for AIR/SWF is still needed
given the state of those technologies.
> Referrer Filter allowance for app://
> ------------------------------------
>
> Key: SLING-10843
> URL: https://issues.apache.org/jira/browse/SLING-10843
> Project: Sling
> Issue Type: Improvement
> Components: Sling Security
> Affects Versions: Security 1.1.20
> Reporter: Cris Rockwell
> Assignee: Cris Rockwell
> Priority: Major
>
> Sling's ReferrerFilter has this code in the isValidRequest method.
> // check for air referrer - which is always allowedif (
> referrer.startsWith("app:/") ) { return true;
> }
> [Sling
> ReferrerFilter|https://github.com/apache/sling-org-apache-sling-security/blob/master/src/main/java/org/apache/sling/security/impl/ReferrerFilter.java]
> There's no need to have app:// as a hard-coded allowance around the Referrer
> Filter, because applications can configure allow.hosts.regexp to allow AIR
> referrer if needed.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
