Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am starting to learn web deployment on my own. I just downloaded an open source, alfresco and trying few things on my own. After so much reading I managed to hide the 8080 url from the site using apache as a proxy server for tomcat. Today I faced a issue, I am able to see the login page but I cant pass through the login page. After seeing the log file I came to know the CSRF filter is causing the issue. I just went to my configuration page and I removed the CSRF filter and it is working.Now, Does CSRF filter required for an intranet site ? Is it possible someone from the internet can perform a XSRF attack on my application

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Yes. It's possible that someone in your intranet is performing such an attack. Even though it's not as likely as on the (wild-wild-wild) internet.

On the other hand you have to have something wrong in your configuration. the CSRF filter of alfresco (or alfresco itself, or on the tomcat container level) needs to have some configuration parameter to make CSRF filter work behind a proxy. Check the docs again.. Just a guess: Maybe you don't work correctly with X-Forwarded-For HTTP headers?

share|improve this answer
    
Yes there is configuration to work behind proxy. Since I am the only user in the lan I wont do an CSRF attack. Is it possible from outside my lan from intranet –  user3275057 Feb 27 at 12:49
    
Do I read "from intranet" as "from internet"? To me LAN and Intranet ist the same. –  gue Feb 27 at 13:24
    
sorry internet I typed wrongly –  user3275057 Feb 27 at 13:25
    
As long as your webserver is not accessible from outside your LAN (firewall?!) wild stuff happening in the internet is not reaching your webserver. So: you should be safe. –  gue Feb 27 at 13:25
    
thank you for the instant reply –  user3275057 Feb 27 at 13:26

Even if you trust every person in your LAN and the server is only reachable from the LAN, you still need to secure it against CSRF.

Consider a user who visits an evil website. That website can now trigger requests with the user's IP and cookies, enabling CSRF attacks against your webserver if it has such vulnerabilities.

But "CSRF filter" sounds a bit weird. The standard CSRF prevention is to send a token (and verify it on the server) with every request that can cause a side-effect. It's important to put the token in a place that doesn't get filled in implicitly by the browser. POST data or custom http headers are fine, cookies and IP are not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.