Re: [jboss-as7-dev] Cross-Origin Resource Sharing
On 02/26/2013 10:16 AM, Heiko Braun wrote:
Btw, what are the security concerns with this?
You connect to the console and authenticate against the server as normal.
You then open a new tab and visit another page, maybe a link someone
sent you in e-mail. That page contains Java script that makes a call to
the application server.
As you are already authenticated that call is accepted by the server and
whatever was requested by that Javascript is executed.
Supporting true cross origin resource sharing is not in itself likely to
be a problem - we just need to be careful regarding what we allow.
On Feb 26, 2013, at 11:12 AM, Heiko Braun <hbraun(a)redhat.com>
wrote:
> Thanks Darran.
>
> On Feb 26, 2013, at 11:07 AM, Darran Lofthouse <darran.lofthouse(a)jboss.com>
wrote:
>
>> Here is the issue: -
>>
>> https://issues.jboss.org/browse/AS7-2564
>>
>> On 02/26/2013 09:56 AM, Darran Lofthouse wrote:
>>> No we never "supported" it - what we had was a HTTP management
interface
>>> potentially vulnerable to cross site scripting attacks. As the console
>>> is served from the same server as the management interface we closed
>>> this down to completely ban cross origin requests.
>>>
>>> There is an old Jira somewhere to look into allowing configuration to
>>> relax it but that would be better to review after moving to Undertow.
>>>
>>> Regards,
>>> Darran Lofthouse.
>>>
>>>
>>> On 02/26/2013 09:47 AM, Heiko Braun wrote:
>>>>
>>>>
>>>> At some point we used to have support for ${subject} for accessing the
domain management HTTP interface. Does anybody remember why it has been removed? Looking
at the current domain API handler implementation it seems CORS has been explicitly been
prevented.
>>>>
>>>> Regards, Heiko
>>>>
>>> _______________________________________________
>>> jboss-as7-dev mailing list
>>> jboss-as7-dev(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/jboss-as7-dev
>>>
>
>
> _______________________________________________
> jboss-as7-dev mailing list
> jboss-as7-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/jboss-as7-dev