[
https://issues.apache.org/jira/browse/SLING-13312?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh resolved SLING-13312.
-------------------------------
Fix Version/s: Security 1.3.2
Resolution: Fixed
> Harden request-origin validation in the ReferrerFilter
> ------------------------------------------------------
>
> Key: SLING-13312
> URL: https://issues.apache.org/jira/browse/SLING-13312
> Project: Sling
> Issue Type: Bug
> Components: Sling Security
> Affects Versions: Security 1.3.0
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: Security 1.3.2
>
>
> The current logic accepts some requests based on weaker evidence than a full
> origin comparison, which weakens the filter's CSRF protection.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
