Jürgen Weber created JSPWIKI-1306:
-------------------------------------
Summary: Whitelist for CsrfProtectionFilter
Key: JSPWIKI-1306
URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
Project: JSPWiki
Issue Type: New Feature
Components: Filters
Affects Versions: 2.12.5, 3.0.0
Reporter: Jürgen Weber
Attachments: CsrfProtectionFilter.patch
CsrfProtectionFilter filters all post requests that do not have the correct
X-XSRF-TOKEN.
So, a post request for a web api in JSPWiki cannot get through, as a rest
client cannot aquire a token.
There should be a whitelist.
The appended patch would open access for servlets in a whitelist.
E.g.
jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
for a servlet at url-pattern/aservlet/*
Apply with git apply CsrfProtectionFilter.patch
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
