Logs with "potential cross-site request forgery "

[italoosorio]

I have jasperserver-pro running behind Apache. I have tomcat configure with multiple vhosts. One is for jasperserver-pro only.

Everything seems to work perfectly. However each time a login process happens in the front-end this message appears in the logs.

It also happens while authenticating using REST services.

****************************************************** Owasp.CsrfGuard Properties** Logger: com.jaspersoft.jasperserver.api.security.JSCsrfLogger* NewTokenLandingPage: /jasperserver-pro/login.html* PRNG: SHA1PRNG* SessionKey: JASPER_CSRF_SESSION_KEY* TokenLength: 96* TokenName: JASPER_CSRF_TOKEN* Ajax: true* Rotate: true* TokenPerPage: true* Action: org.owasp.csrfguard.action.Rotate* Action: org.owasp.csrfguard.action.Redirect*       Parameter: Page = /jasperserver-pro/login.html* Action: org.owasp.csrfguard.action.Log*       Parameter: Message = potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, uri:%request_uri%, error:%exception_message%)*****************************************************

I would like to know what is triggering this message and how to configure jasperserver properly to avoid it.

Post Edited by italoosorio at 04/29/2012 21:46

[Ching Ice-creaming]

http://jasperforge.org/plugins/espforum/view.php?group_id=112&forumid=102&topicid=95352

[italoosorio]

Yes, I tried that before plus other things and it did not fix the log problem.

I have it setup on this way: security.validation.csrf.on=true I chnage it to:  security.validation.csrf.on=false, no effect.

However, a solution which disables security does not seem much attractive.

Post Edited by italoosorio at 04/30/2012 00:27

[italoosorio]

 I got this solved thank you to JasperSever support. Here is their comment:

I stumbled across a couple of similar cases.  It seems that CsrfGuard log is set to INFO in this release.  This is getting changed in a future release. You can fix this by modifying jasperserver-pro/WEB-INF/web.xml:

<context-param>
    <param-name>Owasp.CsrfGuard.Config.Print</param-name>
   <param-value>true</param-value>
</context-param>

Change the value to false to suppress CSRF warnings

Now the mesage if not showing in the log anymore.

[hozawa]

Seems it's still not changed in 5.5.0.