geronimo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Forrest Xia (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (GERONIMO-6348) XSSXSRFFilter blocked HttpServletRequest due to invalid FORM content
Date Fri, 18 May 2012 09:14:09 GMT

    [ https://issues.apache.org/jira/browse/GERONIMO-6348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13278658#comment-13278658
] 

Forrest Xia commented on GERONIMO-6348:
---------------------------------------

There is another scenario when using IE to happen with this reported issue:

1) Start geronimo
2) Open http://localhost:8080/console/ in browser and enter usual username / password
3) Open http://localhost:8080/console/ again in the same tab / window <- that's the important
step
4) Shutdown and start geronimo again
5) Open http://localhost:8080/console/ again in the same tab / window as before. You should
get the login screen now. 
6) Enter username / password and hit enter - and now you should see the error.

After debugging, I found IE will send a different formId from the saved one in the http session
to the server when using the same window to login console again after server restart. I observed
that the formId is the old one before the server restarts. However, firefox does not have
this issue.

So just commit a workaround for IE to let the XSSXSRFFilter message gone. 
                
> XSSXSRFFilter blocked HttpServletRequest due to invalid FORM content
> --------------------------------------------------------------------
>
>                 Key: GERONIMO-6348
>                 URL: https://issues.apache.org/jira/browse/GERONIMO-6348
>             Project: Geronimo
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: console
>    Affects Versions: 3.0-beta-1
>         Environment: Windows, IE8 with compatibility mode on or Eclipse internal web
browser.
>            Reporter: Jarek Gawor
>
> When using the admin console on Windows with IE8 with compatibility mode on the following
messages are generated on each click:
> 2012-05-10 01:57:10,307 WARN  [XSRFHandler] Blocked due to missing HttpServletRequest
parameter.
> 2012-05-10 01:57:10,307 ERROR [XSSXSRFFilter] XSSXSRFFilter blocked HttpServletRequest
due to invalid FORM content.
> These messages are generated each time a request is made to access /console/dojo/dojo/resources/blank.html.
It looks like Dojo has a special case for IE which generates this extra request not seen on
other browsers.
> The problem is also visible using the Eclipse's internal web browser which automatically
gets configured with IE compatibility mode.
> These errors look harmless but can be very confusing and annoying to users so I think
we need to find some way to avoid them.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

Mime
View raw message