[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jürgen Weber updated JSPWIKI-1306:
----------------------------------
Attachment: (was: CsrfProtectionFilter.patch)
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.patch
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
