[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135189#comment-18135189
]
Arturo Bernal commented on JSPWIKI-1306:
----------------------------------------
Hi Jürgen, thanks for the use case.
A whitelist in CsrfProtectionFilter would exempt every request to the listed
paths from the token check. For a Web Share Target I think that is more than
needed. The share target only has to hand text to the wiki, and the wiki does
not have to save it on that request.
A narrower option: a dedicated endpoint that accepts the shared title, text and
url, and then shows the editor with that content prefilled. The save from the
editor is a normal POST and carries the token. Then no state-changing request
skips the CSRF check. I have not tried this, so it is a proposal and not
something I have verified.
Note that a share target declared in a web app manifest may require the POST to
be a form submission (multipart or urlencoded). The prefill endpoint would have
to read that, so it needs a check against the manifest spec.
For a future REST API, I would handle that separately, with its own
authentication rather than the session token.
Does the prefilled editor cover what you want to do, or do you need the share
to save a page directly?
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
