Lukasz Lenart created WW-5754:
---------------------------------
Summary: Fetch Metadata policy rejects cross-site POST and HEAD
navigations since WW-5753
Key: WW-5754
URL: https://issues.apache.org/jira/browse/WW-5754
Project: Struts 2
Issue Type: Bug
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.5.0
Follow-up to [WW-5753|https://issues.apache.org/jira/browse/WW-5753] (PR
[#1983|https://github.com/apache/struts/pull/1983]).
After WW-5753, {{StrutsResourceIsolationPolicy.isAllowedTopLevelNavigation}}
accepts a cross-site request only when {{Sec-Fetch-Mode}} is {{navigate}} *and*
the method is {{GET}}. {{FetchMetadataInterceptor}} is part of
{{defaultStack}}, so with the default configuration the following now get a
403. Every release since 6.0.0 accepted them:
* Cross-site POST navigations, for example a SAML or OIDC {{form_post}}
response to an action, or a payment gateway posting the user back to the
application.
* Cross-site {{HEAD}} navigations. The [Fetch Metadata interceptor
documentation|https://struts.apache.org/core-developers/fetch-metadata-interceptor]
lists {{HEAD}} alongside {{GET}} as an accepted method.
The only way out today is {{exemptedPaths}}. It is matched against
{{request.getContextPath()}} ({{FetchMetadataInterceptor}}), so any entry
exempts the whole web application, not a single action.
h2. Options
# Accept a cross-site request when {{Sec-Fetch-Mode}} is {{navigate}}, whatever
the method, as long as the destination is not {{object}} or {{embed}}.
Cross-site subresource requests stay rejected, and form-post and redirect-back
flows keep working.
# Keep the GET-only rule, add {{HEAD}}, and document the change as breaking in
the 7.5.0 Version Notes and the Migration Guide, with a supported way to exempt
individual actions.
h2. Also
* Decide whether {{exemptedPaths}} should be matched against the request path
(servlet path plus path info) rather than the context path.
* {{FetchMetadataInterceptorTest.testValidTopLevelNavigation}} sends no
{{Sec-Fetch-Site}} header, so it returns at the empty-site check and never
reaches the navigation branch. Make it set {{cross-site}}, or drop it in favour
of {{testCrossSiteTopLevelGetNavigationAllowed}}.
* Add tests for a cross-site POST navigation and a cross-site HEAD navigation,
asserting whichever behaviour is chosen.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
