In response to Tihomir reporting this issue on #guvnor and further poking by zenix I logged the following headers:- ===> Fail http://127.0.0.1:8888/org.drools.guvnor.Guvnor/guvnorService POST /org.drools.guvnor.Guvnor/guvnorService HTTP/1.1 Host: 127.0.0.1:8888 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.10 (maverick) Firefox/3.6.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Content-Length: 154 Content-Type: text/x-gwt-rpc; charset=utf-8 Referer: http://127.0.0.1:8888/org.drools.guvnor.Guvnor/Guvnor.html?gwt.codesvr=12... Cookie: standalone_usage=true Pragma: no-cache Cache-Control: no-cache 7|0|4| http://127.0.0.1:8888/org.drools.guvnor.Guvnor/|6808FDC8A4FA3491026441B59... HTTP/1.1 400 Bad Request Content-Type: text/plain;charset=ISO-8859-1 Transfer-Encoding: chunked Date: Wed, 23 Mar 2011 20:11:04 GMT Server: Apache-Coyote/1.1 Connection: close ===> Success http://127.0.0.1:8888/org.drools.guvnor.Guvnor/guvnorService POST /org.drools.guvnor.Guvnor/guvnorService HTTP/1.1 Host: 127.0.0.1:8888 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.10 (maverick) Firefox/3.6.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive *X-GWT-Permutation: HostedMode X-GWT-Module-Base: http://127.0.0.1:8888/org.drools.guvnor.Guvnor/ *Content-Type: text/x-gwt-rpc; charset=utf-8 Referer: http://127.0.0.1:8888/org.drools.guvnor.Guvnor/Guvnor.html?gwt.codesvr=12... Content-Length: 154 Cookie: standalone_usage=true Pragma: no-cache Cache-Control: no-cache 7|0|4| http://127.0.0.1:8888/org.drools.guvnor.Guvnor/|41FA1D8B82DBBBC875605A4A2... HTTP/1.1 200 OK Content-Disposition: attachment Content-Type: application/json;charset=utf-8 Content-Length: 48 Date: Wed, 23 Mar 2011 20:15:38 GMT Server: Apache-Coyote/1.1 So, the required GWT "X-GWT-Permutation" header is definately missing. I've posted a question to the GWT forums to see if its a known issue. Has anybody experienced this in "Web" mode? Cheers, Mike On 3 February 2011 16:52, Michael Anstis <michael.anstis(a)gmail.com&gt; wrote:

So, realistically we can expect our users to notice the hick-up at some stage with 5.2.0 (or GWT2.1+ in reality). Should we consider an emergency game-plan should a fix not be found prior to release? e.g. Remove XSRF protection short-term. It doesn't leave Guvnor any more exposed than we were pre-GWT2.1). I've posted to GWT's forums but had no response as yet. Views anybody? Cheers, Mike On 24 March 2011 14:26, Tihomir Surdilovic <tsurdilo(a)redhat.com&gt; wrote:

On 3/24/11 10:54 AM, Michael Anstis wrote: Same here. Does not happen for me in Chrome.

I recall there was some analysis done on general vulnerabilities by the Red Hat security team - the main concern I remember wasn't XSRF but variants on XSS. Even then - the real concern was that there was/is dynamic code executed which comes from the client (could allow for elevated priviledges). I think the general agreement at the time was that usage on more public networks with less trusted users was not going to be recommended anyway. But XSRF does seem more serious - if you can eliminate that class of attack then you are left with users who the system already trusts (has to - they are writing rules). On Fri, Mar 25, 2011 at 1:34 AM, Michael Anstis <michael.anstis(a)gmail.com&gt;wrote: -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com