Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Implement CSRF Prevention

Description

Overview

This is a follow-up to the investigation done for MODLOGSAML-59 / MODLOGSAML-58 and covers implementation of the design outlined on the wiki

Acceptance Criteria

  • CORS handling is done by the module

  • * tenant-specific origin whitelist

  • * Access-Control-Allow-Origin is set to the origin, not *

  • * Access-Control-Allow-Credentials is set to true for /saml/login

  • CSRF prevention is implemented via RelayState and a associated cookie

Environment

None

Potential Workaround

None

blocks

is blocked by

relates to

Checklist

hide

TestRail: Results

Activity

Show:
Done

Details

Assignee

Reporter

Labels

Priority

Story Points

Sprint

Development Team

Core: Platform

Parent

Fix versions

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs

Created May 21, 2020 at 1:40 PM
Updated July 8, 2021 at 4:10 PM
Resolved May 24, 2021 at 12:01 PM
TestRail: Cases
TestRail: Runs

Flag notifications