[
https://issues.apache.org/jira/browse/SLING-10843?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17422587#comment-17422587
]
Robert Munteanu commented on SLING-10843:
-----------------------------------------
Thanks, [~acollign]!
> Referrer Filter allowance for app://
> ------------------------------------
>
> Key: SLING-10843
> URL: https://issues.apache.org/jira/browse/SLING-10843
> Project: Sling
> Issue Type: Improvement
> Components: Sling Security
> Affects Versions: Security 1.1.20
> Reporter: Cris Rockwell
> Assignee: Cris Rockwell
> Priority: Major
>
> Sling's ReferrerFilter has this code in the isValidRequest method.
> // check for air referrer - which is always allowedif (
> referrer.startsWith("app:/") ) { return true;
> }
> [Sling
> ReferrerFilter|https://github.com/apache/sling-org-apache-sling-security/blob/master/src/main/java/org/apache/sling/security/impl/ReferrerFilter.java]
> There's no need to have app:// as a hard-coded allowance around the Referrer
> Filter, because applications can configure allow.hosts.regexp to allow AIR
> referrer if needed.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
