CsrfFilter
Prevent Cross Site Request Forgery (CSRF) attacks when using cookie-based authentication, as follows:
When a session is created or updated for a client, generate a CSRF token as a hash of the session cookie.
Send the token in a response header to the client, and require the client to provide that header in subsequent requests.
In subsequent requests, compare the provided token to the generated token.
If the token is not provided or can't be validated, reject the request and return a valid CSRF token transparently in the response header.
Rogue websites that attempt CSRF attacks operate in a different website domain to the targeted website. Because of same-origin policy, rogue websites can't access a response from the targeted website, and cannot, therefore, access the CSRF token.
Usage
{
"name": string,
"type": "CsrfFilter",
"config": {
"cookieName": configuration expression<string>,
"headerName": configuration expression<string>,
"excludeSafeMethods": configuration expression<boolean>,
"failureHandler": handler reference
}
}Properties
"cookieName": configuration expression<string>, requiredThe name of the cookie used to store the session ID, where iPlanetDirectoryPro is the name of the default AM session cookie. To find the name of your AM session cookie, see "Find the Name of Your AM Session Cookie".
"headerName": configuration expression<string>, optionalThe name of the header that carries the CSRF token. The same header is used to create and verify the token.
Default:
X-CSRF-Token"excludeSafeMethods": configuration expression<boolean>, optionalWhether to exclude GET, HEAD, and OPTION methods from CSRF testing. In most cases, these methods are assumed as safe from CSRF.
Default:
true"failureHandler": handler reference, optionalHandler to treat the request if the CSRF the token is not provided or can't be validated. Provide an inline handler declaration, or the name of a handler object defined in the heap.
Although IG returns the CSRF token transparently in the response header, this handler cannot access the CSRF token.
Default: Handler that generates
HTTP 403 Forbidden.
Example
For an example of how to harden protection against CSRF attacks, see Protecting Against CSRF Attacks.
{
"name": "CsrfFilter-1",
"type": "CsrfFilter",
"config": {
"cookieName": "openig-jwt-session",
"headerName": "X-CSRF-Token",
"excludeSafeMethods": true
}
}