I checked the answers and comments on that post, and they are wrong. When you place your application behind a reverse http proxy, you need to make sure the proxy passes the correct headers to your application and you application needs to use these headers.
For WildFly, you need to add proxy-address-forwarding="true" to the http- listener. This will instruct Undertow to read the headers passed by the proxy. On your proxy you will want to set these headers (this is nginx config): proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; Best regards, Emond Papegaaij On zaterdag 22 december 2018 12:46:11 CET Chris Turchin wrote: > This might help: > https://stackoverflow.com/questions/46337253/apache-reverse-proxy-and-wicket > -csrfpreventionrequestcyclelistener > On Sat, Dec 22, 2018 at 3:28 AM ShengChe Hsiao <front...@gmail.com> wrote: > > Dear all > > > > I use apache httpd as wildlfy's backend proxy server to redirect http > > request to https request, when i add CsrfPreventionRequestCycleListener to > > my application , it showd error message: > > > > [org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener] > > (default task-48) Possible CSRF attack, request URL: http:// > > etalking.chc.edu.tw/agency/index, Origin: https://etalking.chc.edu.tw, > > action: aborted with error 400 Origin does not correspond to request > > > > How can i conquer this? > > -------------------------------------------------------------------- > > -----------------------------------> > > To boldly go where no man has gone before. > > -------------------------------------------------------------------- > > -----------------------------------> > > We do this not because it is easy. We do this because it is hard. > > ----------------------------------------------------------------- > > --------------------------------------> > > If I have seen further it is by standing on the shoulders of giants. > > ---------------------------------------------------------- > > ---------------------------------------------> > > front...@gmail.com > > -------------------------------------------------------------------------- > > -------------------> --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org For additional commands, e-mail: users-h...@wicket.apache.org
