Skip to:

Skip to Jira Navigation
Skip to Side Navigation
Skip to Main Content

Description

None

CSP Request Details

None

CSP Rejection Details

None

Potential Workaround

None

Linked issues

blocks

Create mod-login-saml security release

Security Audit raised issues

is blocked by

Implement CSRF Prevention

Conditionally defer CORS handling to module when invoked via passthrough API

Set credentials: include on fetch to /saml/login

CORS delegation doesn't work with preflight/OPTIONS requests

relates to

Umbrella: Cross-Site Request Forgery (CSRF) in SSO Flow

Checklist

hide

TestRail: Results

Activity

Show:

Craig McNally May 21, 2020 at 1:41 PM
Edited

Created https://folio-org.atlassian.net/browse/MODLOGSAML-63#icft=MODLOGSAML-63, https://folio-org.atlassian.net/browse/OKAPI-847#icft=OKAPI-847, and https://folio-org.atlassian.net/browse/STRIPES-683#icft=STRIPES-683 for the implementation of a fix for this. Once those are complete, this can be unblocked and closed.

Craig McNally May 18, 2020 at 12:28 PM
Edited

https://folio-org.atlassian.net/wiki/display/DD/SAML+CSRF+Prevention

Details
Assignee
Hongwei Ji
Reporter
Jakub Skoczen
Priority
P2
Story Points
2
Sprint
None
Development Team
Core: Platform
Fix versions
2.2.0
TestRail: Cases
Open TestRail: Cases
TestRail: Runs
Open TestRail: Runs

TestRail: Cases

TestRail: Runs