BPM, Workflow, and Case

Hi guys:

  Since the CSRF protection is enabled on a BAW sever,  it's failed to access Portal process link embed in email content that always get an error as:

"HTTP request to was blocked by CSRF Filtering"

I try to add the host of email service (https://xxx.xx.com) to the whitelist in order to fix this. But it's still not working.

May you guys help to advise? Tks!

Hi Eddi,
when you read https://www.ibm.com/docs/en/baw/20.x?topic=environment-security-hardening-properties carefully, it says for Security.CsrfProtectionRefererWhitelist 

The value of this property must be a comma-separated list of fully qualified host names that are valid values for the Referer header field. By restricting values to host names that serve user interfaces for Business Automation Workflow, you can mitigate CSRF. For more information about the Referer header field, see the Request for Comments (RFC) 7231 documentation.

The sample uses a hostname without protocol scheme, too:
AdminTask.setBPMProperty(['-de', 'De1', '-name', 'Security.CsrfProtectionRefererWhitelist', '-value', 'fmtc4090.boeblingen.de.ibm.com'])

In doubt, enable trace for com.ibm.bpm.servlet.filters.*=all to see the exact header value that the system was unhappy with.

Hi guys:

  Since the CSRF protection is enabled on a BAW sever,  it's failed to access Portal process link embed in email content that always get an error as:

"HTTP request to was blocked by CSRF Filtering"

I try to add the host of email service (https://xxx.xx.com) to the whitelist in order to fix this. But it's still not working.

May you guys help to advise? Tks!

Hi guys:

  Since the CSRF protection is enabled on a BAW sever,  it's failed to access Portal process link embed in email content that always get an error as:

"HTTP request to was blocked by CSRF Filtering"

I try to add the host of email service (https://xxx.xx.com) to the allowed list in order to fix this. But it's still not working.

May you guys help to advise? Tks!

*=info:com.ibm.bpm.servlet.filters.*=all​

You should see a log message about the request being blocked and right before that in the same thread you should see the exact header coming in passed to a method isValidReferrerHeader

You can also try to copy the URL from the email into your browser as a temporary work-around. This should cause an empty Referer header, which is acceptable.

HTH

Jens

Hi guys:

  Since the CSRF protection is enabled on a BAW sever,  it's failed to access Portal process link embed in email content that always get an error as:

"HTTP request to was blocked by CSRF Filtering"

I try to add the host of email service (https://xxx.xx.com) to the allowed list in order to fix this. But it's still not working.

May you guys help to advise? Tks!