[Dev] "Error 403 - Forbidden" when session expires in admin console

Hi all, When trying to perform operations through admin console, once the session is expired we are getting a 403 from admin console. Seems like this occurs due to CSRF filter blocking the request since the session is no longer available at the server side. [2016-07-06 15:34:27,576] WARN {org.ow

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Pubudu, On Fri, Jul 8, 2016 at 5:29 PM, Pubudu Priyashan wrote: > [+Senduran] > > We have found the same issue [1] in ESB wso2esb-5.0.0-pre-RC2.zip pack. > > [1] https://wso2.org/jira/browse/ESBJAVA-4741 > This issue has been fixed by applying required filters in property file. We will updat

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Thanks Jagath. We will test the fix once it's made available. Cheers, Pubudu. On Friday, 8 July 2016, Jagath Sisirakumara Ariyarathne wrote: > Hi Pubudu, > > On Fri, Jul 8, 2016 at 5:29 PM, Pubudu Priyashan > wrote: > >> [+Senduran] >> >> We have found the same issue [1] in ESB wso2esb-5.0.0-p

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Team, We identified that disabling "ValidateWhenNoSessionExists" property similar to following can resolve original session-timeout issue raised by Hasintha. org.owasp.csrfguard.ValidateWhenNoSessionExists = false Please add below lines in product "distribution" pom file to correct this beha

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Ayoma, We are facing this issue when uploading registry resource and uploading rxts when session gets expired. We have changed the "org.owasp.csrfguard.ValidateWhenNoSessionExists" property to false. But it still gives the following error messages [1],[2]. After reloading the page then issue do

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Rajith, "org.owasp.csrfguard.ValidateWhenNoSessionExists" is only relevant to session timeout scenario Hasintha mentioned. Regarding "/fileupload/resource", please have a look at "Integration Checklist", last item from [1]. Let's have a look at "/carbon/generic" URL separately and see what is

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi, The file upload works fine, this happens only when session expires. This is only two scenarios I have mentioned above. There can be other scenarios as well this might happen due to session timeout. Thanks! Rajith On Mon, Jul 11, 2016 at 1:14 PM, Ayoma Wijethunga wrote: > Hi Rajith, > > "org

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Ayoma, I found this same error after restarting the server. Please find the steps to reproduce the issue. 1. Start the server, 2. Go to Management console and do loging and then logout. 3. Don't close the browser window. 4. Restart the server. 5. Open the management console login page in new b

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Madhawa, Thanks for reporting this. Seems to be an edge case. I was able to reproduce it. We are looking into how to mitigate this. Thanks, Dulanja On Tue, Jul 12, 2016 at 4:39 PM, Madhawa Gunasekara wrote: > Hi Ayoma, > > I found this same error after restarting the server. Please find th

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Hasintha, Possibly this might be due to multiple network interfaces on the hosting machine. Please check your servers' listening IP and the request IP. Thanks, Rasika On Wed, Jul 6, 2016 at 4:10 PM, Hasintha Indrajee wrote: > Hi all, > > When trying to perform operations through admin conso

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

[+Dulanjan] Hi All When trying to add multiple roles to a user using a feature such as *Select all from page 1 to page 3* or clicking on a pagination number the same error comes and throws an error similar to[1] [1] [2016-07-07 11:34:37,139] WARN - JavaLogger potential cross-site request forger

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

[+Senduran] We have found the same issue [1] in ESB wso2esb-5.0.0-pre-RC2.zip pack. [1] https://wso2.org/jira/browse/ESBJAVA-4741 Pubudu D.P Senior Software Engineer - QA Team | WSO2 inc. Mobile : +94775464547 Linkedin: https://uk.linkedin.com/in/pubududp Medium: https://medium.com/@pubududp

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Pubudu / Senduran, This is not the exact same. "/carbon/proxyservices/" is one of EBS CSRF exclusion patterns (referring to previous filter configuration [1]). As discussed with Senduran over the call we had, this pattern needs to be added to OWASP CSRFGuard as a unprotected URL pattern ([2] s

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Ayoma, I had a look at "repository/conf/security/Owasp.CsrfGuard.Carbon.properties" file and I can see the property [1] included in it. Can you please confirm that this is as expected? Thanks! [1] org.owasp.csrfguard.unprotected.Services=%servletContext%/services/* Cheers, Pubudu. Pubudu D.P

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

Hi Pubudu This is only the pattern coming from kernel itself. Product level exclusions are not there in the property file. Please check with product team on this. Best Regards, Ayoma On Fri, Jul 8, 2016 at 5:59 PM, Pubudu Priyashan wrote: > Hi Ayoma, > > I had a look at " > repository/conf/sec

Re: [Dev] "Error 403 - Forbidden" when session expires in admin console

On Thu, Jul 7, 2016 at 4:53 PM, Ayoma Wijethunga wrote: > Hi All, > > Original issue reported by Hasintha is relevant to how we handle session > timeout conditions with CSRFGuard filter. We are working on this and will > update with a resolution. > The reason for this behavior is there's no sess