Page Comparison

...

Add the following code snippet within the <Security> element of the <PRODUCT_HOME>/repository/conf/carbon.xml file.

Code Block

language	xml

<CSRFPreventionConfig>
    <CSRFValve>
        <Enabled>true</Enabled>
        <!-Enable/Disable CSRF prevention->
        <Rule>allow</Rule>

        <!--URL Pattern to skip the CSRF prevention-->
        <Patterns>
            <Pattern>commonauth</Pattern>
            <Pattern>samlsso</Pattern>
            <Pattern>authenticationendpoint</Pattern>
            <Pattern>wso2</Pattern>
            <Pattern>oauth2</Pattern>
            <Pattern>openid</Pattern>
            <Pattern>openidserver</Pattern>
            <Pattern>passivests</Pattern>
            <Pattern>services</Pattern>
        </Patterns>
		
		<!--List of URL to allow as source to access the system-->
        <WhiteList>
            <Url>https://localhost:9443</Url>
        </WhiteList>
    </CSRFValve>
</CSRFPreventionConfig>

Edit the <Whitelist> element of the code snippet above by adding the relevant list of URLs that are approved sources.
Add the following configuration within the <Hosts><Host> element of the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file.
Code Block
language xml
<Valve className="org.wso2.carbon.ui.valve.CSRFValve"/>
Restart the product server.

...

Versions Compared

Old Version 27

New Version Current

Key