Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-24828

Make the CSRF filter work with the Firefox Nuxeo browser extension

    XMLWordPrintable

    Details

      Description

      Since resolution of NXP-24331, hot reload and other functionalities from the dev tools browser extension in Firefox are not available, with the following warnings displayed in server.log:

      [NuxeoCorsCsrfFilter] CSRF check failure: source: moz-extension://b168a0e9-b1e5-4f9c-adef-77cbb980e2be does not match target: http://localhost:8080/ and not allowed by CORS config

      Similar problems occur when using the Postman Chrome extension, which allows REST API testing.

      We cannot allow "moz-extension://*" as an origin because * is not a legal hostname.

      We should whitelist moz-extension and chrome-extension schemes in CORS filter to enable these extensions.

        Attachments

          Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. NXP-24331 CSRF Protection for Platform

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. BDE-113 Hide go to Studio project link when instance is not registered

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. BDE-133 Fix error message doesn't appear if dependencies are not matched

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          New Feature - A new feature of the product, which has yet to be developed. NXDOC-1564 Fix nuxeo-dev-tools incompatible out of the box with new CSRF policy on FireFox

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. BDE-148 Add warning to README about FF bug in 10.1

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 hours
                  2h