<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Possible CSRF attack noted when asserting referer header in Alfresco Archive</title>
    <link>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292005#M245135</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;SPAN&gt;I did a search for this in the forums and I came to this &lt;/SPAN&gt;&lt;A href="http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/installation-upgrades/csrffilter-error" rel="nofollow noopener noreferrer"&gt;THREAD&lt;/A&gt;&lt;SPAN&gt; in that thread there is a link to a JIRA issue that was raised on it. Supposedly this was to be fixed in 4.2.d.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;I'm having an issue using 4.2.d when trying to log in. Here is the exception that comes up.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;PRE class="language-none line-numbers"&gt;&lt;CODE&gt;&lt;BR /&gt;javax.servlet.ServletException: Possible CSRF attack noted when asserting referer header '&lt;A href="https://FQDN/share/page/" rel="nofollow noopener noreferrer"&gt;https://FQDN/share/page/&lt;/A&gt;'. Request: POST /share/page/dologin, FAILED TEST: Assert referer POST /share/page/dologin :: referer: '&lt;A href="https://FQDN/share/page/" rel="nofollow noopener noreferrer"&gt;https://FQDN/share/page/&lt;/A&gt;' vs server &amp;amp;amp; context: &lt;A href="http://127.0.0.1:8080/" rel="nofollow noopener noreferrer"&gt;http://127.0.0.1:8080/&lt;/A&gt; (string) or FQDN:443 (regexp)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.alfresco.web.site.servlet.CSRFFilter$AssertRefererAction.run(CSRFFilter.java:920)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.alfresco.web.site.servlet.CSRFFilter.doFilter(CSRFFilter.java:310)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.alfresco.web.site.servlet.SSOAuthenticationFilter.doFilter(SSOAuthenticationFilter.java:378)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at org.apache.tomcat.util.net.AprEndpoint$SocketWithOptionsProcessor.run(AprEndpoint.java:1810)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;at java.lang.Thread.run(Thread.java:724)&lt;BR /&gt;&lt;SPAN class="line-numbers-rows"&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/CODE&gt;&lt;/PRE&gt;&lt;BR /&gt;&lt;SPAN&gt;I'm on linux 6.4 CentOS using apache as my ssl authentication. According to the JIRA link in the above link I mentioned there is some code to insert into share-config-custom.xml. I did so and put the referer (4 places) as my FQDN:443&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;My apache config looks like this…&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;PRE class="language-none line-numbers"&gt;&lt;CODE&gt;&lt;BR /&gt;&amp;lt;VirtualHost *:443&amp;gt;&lt;BR /&gt;&amp;nbsp; ServerName FQDN&lt;BR /&gt;&lt;BR /&gt;&amp;nbsp; SSLEngine on&lt;BR /&gt;&amp;nbsp; SSLCertificateKeyFile &lt;BR /&gt;&amp;nbsp; SSLCertificateFile &lt;BR /&gt;&amp;nbsp; SSLCACertificateFile omitted these lines from your view&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&amp;nbsp; ProxyPass /paste &lt;A href="http://192.168.3.125/paste/" rel="nofollow noopener noreferrer"&gt;http://192.168.3.125/paste/&lt;/A&gt;&lt;BR /&gt;&amp;nbsp; ProxyPassReverse /paste &lt;A href="http://192.168.3.125/paste/" rel="nofollow noopener noreferrer"&gt;http://192.168.3.125/paste/&lt;/A&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&amp;nbsp; ProxyPass / &lt;A href="http://127.0.0.1:8080/" rel="nofollow noopener noreferrer"&gt;http://127.0.0.1:8080/&lt;/A&gt;&lt;BR /&gt;&amp;nbsp; ProxyPassReverse / &lt;A href="http://127.0.0.1:8080/" rel="nofollow noopener noreferrer"&gt;http://127.0.0.1:8080/&lt;/A&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&amp;nbsp; ProxyTimeout 300&lt;BR /&gt;&amp;nbsp; SSLProxyEngine on&lt;BR /&gt;&lt;BR /&gt;&amp;nbsp; &amp;lt;Proxy *&amp;gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; allow from all&lt;BR /&gt;&amp;nbsp; &amp;lt;/Proxy&amp;gt;&lt;BR /&gt;&lt;BR /&gt;&amp;lt;/VirtualHost&amp;gt;&lt;BR /&gt;&lt;SPAN class="line-numbers-rows"&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/CODE&gt;&lt;/PRE&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;I'm wondering if anyone else is having this issue AND/OR why this is still happening if it was to be fixed in 4.2.d.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;Any input on the resolution of this would be great. I'm wanting to move to 4.2.d from 4.2.c.&lt;/SPAN&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Wed, 25 Sep 2013 17:23:59 GMT</pubDate>
    <dc:creator>eswbitto</dc:creator>
    <dc:date>2013-09-25T17:23:59Z</dc:date>
    <item>
      <title>Possible CSRF attack noted when asserting referer header</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292005#M245135</link>
      <description>I did a search for this in the forums and I came to this THREAD in that thread there is a link to a JIRA issue that was raised on it. Supposedly this was to be fixed in 4.2.d.I'm having an issue using 4.2.d when trying to log in. Here is the exception that comes up.javax.servlet.ServletException: Po</description>
      <pubDate>Wed, 25 Sep 2013 17:23:59 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292005#M245135</guid>
      <dc:creator>eswbitto</dc:creator>
      <dc:date>2013-09-25T17:23:59Z</dc:date>
    </item>
    <item>
      <title>Re: Possible CSRF attack noted when asserting referer header</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292006#M245136</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;SPAN&gt;What doesn't make sense to me is that….when I first downloaded 4.2.d to install on the server. I installed the software. Configured it and it all worked with no problems whatsoever. I had to reboot the server and since that time I can not get 4.2.d to work. &lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;I followed the instructions from &lt;/SPAN&gt;&lt;A href="http://blogs.alfresco.com/wp/ewinlof/2013/03/11/introducing-the-new-csrf-filter-in-alfresco-share/" rel="nofollow noopener noreferrer"&gt;HERE&lt;/A&gt;&lt;SPAN&gt; with no success. I'm scratching my head and running out of ideas to try.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 26 Sep 2013 17:12:52 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292006#M245136</guid>
      <dc:creator>eswbitto</dc:creator>
      <dc:date>2013-09-26T17:12:52Z</dc:date>
    </item>
    <item>
      <title>Re: Possible CSRF attack noted when asserting referer header</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292007#M245137</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;SPAN&gt;Solved:&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;The referer I was using was slightly not correct. It is working perfectly now. See the attached txt file.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Thu, 26 Sep 2013 20:24:06 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/possible-csrf-attack-noted-when-asserting-referer-header/m-p/292007#M245137</guid>
      <dc:creator>eswbitto</dc:creator>
      <dc:date>2013-09-26T20:24:06Z</dc:date>
    </item>
  </channel>
</rss>

