Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am starting to learn web deployment on my own. I just downloaded an open source, alfresco and trying few things on my own. After so much reading I managed to hide the 8080 url from the site using apache as a proxy server for tomcat. Today I faced a issue, I am able to see the login page but I cant pass through the login page. After seeing the log file I came to know the CSRF filter is causing the issue. I just went to my configuration page and I removed the CSRF filter and it is working.Now, Does CSRF filter required for an intranet site ? Is it possible someone from the internet can perform a XSRF attack on my application

share|improve this question
up vote 3 down vote accepted

Yes. It's possible that someone in your intranet is performing such an attack. Even though it's not as likely as on the (wild-wild-wild) internet.

On the other hand you have to have something wrong in your configuration. the CSRF filter of alfresco (or alfresco itself, or on the tomcat container level) needs to have some configuration parameter to make CSRF filter work behind a proxy. Check the docs again.. Just a guess: Maybe you don't work correctly with X-Forwarded-For HTTP headers?

share|improve this answer
Yes there is configuration to work behind proxy. Since I am the only user in the lan I wont do an CSRF attack. Is it possible from outside my lan from intranet – samnaction Feb 27 '14 at 12:49
Do I read "from intranet" as "from internet"? To me LAN and Intranet ist the same. – gue Feb 27 '14 at 13:24
sorry internet I typed wrongly – samnaction Feb 27 '14 at 13:25
As long as your webserver is not accessible from outside your LAN (firewall?!) wild stuff happening in the internet is not reaching your webserver. So: you should be safe. – gue Feb 27 '14 at 13:25
thank you for the instant reply – samnaction Feb 27 '14 at 13:26

Even if you trust every person in your LAN and the server is only reachable from the LAN, you still need to secure it against CSRF.

Consider a user who visits an evil website. That website can now trigger requests with the user's IP and cookies, enabling CSRF attacks against your webserver if it has such vulnerabilities.

But "CSRF filter" sounds a bit weird. The standard CSRF prevention is to send a token (and verify it on the server) with every request that can cause a side-effect. It's important to put the token in a place that doesn't get filled in implicitly by the browser. POST data or custom http headers are fine, cookies and IP are not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.