Mailing-List: contact users-help@wicket.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@wicket.apache.org
MIME-Version: 1.0
In-Reply-To: <CAJmbs8gs+YkTSP8iuxTq+x5TsS5r=kUip0v0gd8wvzySyGT2AA@mail.gmail.com>
References: <CAJmbs8j1DzvcMN0QOi2Y0v8C2aG65ujRJY4R4vP6VoHVAKRb1w@mail.gmail.com>
 <CAJmbs8idvr-cbK=ferBQ7hMe0=JxfbXEZSJ-i7ANd0OiUYN27w@mail.gmail.com>
 <CAMomwMr6R_c7xsz-AceSeeoB9Kx=5gHgEVNaywNpDoWLG8td6A@mail.gmail.com> <CAJmbs8gs+YkTSP8iuxTq+x5TsS5r=kUip0v0gd8wvzySyGT2AA@mail.gmail.com>
From: Maxim Solodovnik <solomax666@gmail.com>
Date: Mon, 15 May 2017 12:54:28 +0700
Message-ID: <CAJmbs8jUGy2K8s3k4oo6+PEJShD7_Dh7s48xXDtjgrJBnRc1-Q@mail.gmail.com>
Subject: Re: WebSockets and CsrfPreventionRequestCycleListener
To: users@wicket.apache.org
Content-Type: text/plain; charset="UTF-8"
archived-at: Mon, 15 May 2017 05:54:34 -0000

Hello Martin,

were you able to take a look at it?
I was hoping to have M6 with working Csrf+WebSockets ....

On Fri, May 12, 2017 at 4:45 PM, Maxim Solodovnik <solomax666@gmail.com> wrote:
> Thanks a million, Martin :)
>
> On Fri, May 12, 2017 at 4:34 PM, Martin Grigorov <mgrigorov@apache.org> wrote:
>> Hi Maxim,
>>
>> I don't use this combination.
>> But I will try to test it soon and see what can be done.
>>
>> Martin Grigorov
>> Wicket Training and Consulting
>> https://twitter.com/mtgrigorov
>>
>> On Fri, May 12, 2017 at 11:00 AM, Maxim Solodovnik <solomax666@gmail.com>
>> wrote:
>>
>>> Does anybody uses this filter?
>>>
>>> On Thu, May 11, 2017 at 10:44 AM, Maxim Solodovnik <solomax666@gmail.com>
>>> wrote:
>>> > Hello All,
>>> >
>>> > just have tried to add CsrfPreventionRequestCycleListener to our
>>> application
>>> > everything seems to work except for Websockets :(
>>> >
>>> > Now I'm getting
>>> >
>>> > [INFO] [http-nio-0.0.0.0-5080-exec-9]
>>> > org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener -
>>> > Possible CSRF attack, request URL:
>>> > /openmeetings/wicket/websocket?pageId=1&wicket-
>>> ajax-baseurl=&wicket-app-name=OpenmeetingsApplication,
>>> > Origin: null, action: aborted with error 400 Origin does not
>>> > correspond to request
>>> > [WARN] [http-nio-0.0.0.0-5080-exec-9]
>>> > org.apache.wicket.protocol.ws.api.WebSocketResponse - An HTTP error
>>> > response in WebSocket communication would not be processed by the
>>> > browser! If you need to send the error code and message to the client
>>> > then configure custom WebSocketResponse via
>>> > WebSocketSettings#newWebSocketResponse() factory method and override
>>> > #sendError() method to write them in an appropriate format for your
>>> > application. The ignored error code is '400' and the message: 'Origin
>>> > does not correspond to request'.
>>> >
>>> > in the logs ...
>>> > What should I do to set Origin for Websockets?
>>> >
>>> > --
>>> > WBR
>>> > Maxim aka solomax
>>>
>>>
>>>
>>> --
>>> WBR
>>> Maxim aka solomax
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
>>> For additional commands, e-mail: users-help@wicket.apache.org
>>>
>>>
>
>
>
> --
> WBR
> Maxim aka solomax


-- 
WBR
Maxim aka solomax

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
For additional commands, e-mail: users-help@wicket.apache.org