security - Csrfguard unprotected resources are protected -


i've added owasp csrfguard project , found resources such css , gif-s protected though defined unprotected next piece of configuration:

org.owasp.csrfguard.unprotected.public=%servletcontext%/resources/* org.owasp.csrfguard.unprotected.css=%servletcontext%/resources/css/main.css org.owasp.csrfguard.unprotected.js=*.js org.owasp.csrfguard.unprotected.scripts=*.js org.owasp.csrfguard.unprotected.styles=*.css org.owasp.csrfguard.unprotected.gif=*.gif org.owasp.csrfguard.unprotected.png=*.png org.owasp.csrfguard.unprotected.jpg=*.jpg

for js-s works fine. what's reason behaviour?thanks in advance.

i'm not sure reason is. know has href attributes (such used css , gif files). unprotected declarations in properties file works fine me when have csrfguard filter on requests (url pattern = "/*"), not when want specify servlet.

however, have found workaround. in web.xml, add init param owaspjavascriptservlet:

<init-param>     <param-name>inject-into-attributes</param-name>     <param-value>false</param-value> </init-param>

then resources href , src attributes should token-free. see documentation.


Comments

Post a Comment

Popular posts from this blog

twig - Using Twigbridge in a Laravel 5.1 Package -

i'm trying create laravel 5.1 package uses twigbridge instead of .php views. can normal .php views display fine, when try make use of .twig templates i'm met error. possible use twigbridge templates when creating views laravel package or pretty stuck blade , php ? edit 1: loading twig template without extending works. it's when start using {% extends 'file' %} error comes out. i error error loading /virtual/laravel/packages/username/mypackage/src/views/sample.twig: template "templates.master" not defined () in "/virtual/laravel/packages/username/mypackage/src/views/sample.twig" @ line 1. my folders username |_ mypackage |_ src |_ controllers - samplecontroller.php |_ views |_ templates - master.twig - sample.twig twig template sample.twig {% extends 'templates.master' %} {% block content %} {{ parent() ...
Read more

jdbc - Not able to establish database connection in eclipse -

i want make new database connection (db2) in eclipse purpose of using jpa. in jpa perspective, in data source explorer view, when try create new db connection, receive following logs when try ping server. org.eclipse.datatools.connectivity.exceptions.dbnotstartexception: no start database command issued. errorcode = -4499, sqlstate = 08001. @ org.eclipse.datatools.enablement.ibm.db2.internal.luw.jdbcluwjdbcconnection.getconnectexception(jdbcluwjdbcconnection.java:74) @ org.eclipse.datatools.connectivity.ui.pingjob.gettestconnectionexception(pingjob.java:81) @ org.eclipse.datatools.connectivity.ui.pingjob.run(pingjob.java:63) @ org.eclipse.core.internal.jobs.worker.run(worker.java:54) caused by: com.ibm.db2.jcc.am.ro: [jcc][t4][2043][11550][4.8.87] exception java.net.connectexception: error opening socket server example.example.com/51.37.93.117 on port 50,000 message: connection timed out: connect. errorcode=-4499, sqlstate=08001 @ com.ibm.db2.jcc.am.gd.a(gd.j...
Read more

firemonkey - How do I make a beep sound in Android using Delphi and the API? -

after having @ androidapi.jni.media.pas, coded following procedure: uses androidapi.jnibridge, androidapi.jni.media; procedure sound(aduration: integer); implementation procedure sound(aduration: integer); var volume: integer; streamtype: integer; tonetype: integer; tonegenerator: jtonegenerator; begin volume := tjtonegenerator.javaclass.max_volume; streamtype := ? tonetype := tjtonegenerator.javaclass.tone_dtmf_0; tonegenerator := tjtonegenerator.javaclass.init(streamtype, volume); tonegenerator.starttone(tonetype, aduration); end; but can't figure out how set value streamtype? thanks the stream type identify stream on beep must played. integer between 0 , 4 : stream_voice_call (0) stream_system (1) stream_ring (2) stream_music(3) stream_alarm(4)
Read more