[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18128257#comment-18128257
]
Jürgen Weber commented on JSPWIKI-1306:
---------------------------------------
Such an endpoint would have to be protected, and so it would run into
j_security_check, wouldn't it?
And, I need the exception for a Web Share Target, and Chrome wouldn't fetch the
token, first.
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
