Latest posts for the topic "Session Error / A request has been denied as a potential CSRF attack."

Session Error / A request has been denied as a potential CSRF attack.

reycyril — GMT

I just installed Mango within a tomcat server :
- Apache Tomcat/7.0.2
- JVM 1.6.0_18-b07

I get popup error windows while browsing within Mango:

- Session Error

Mango log show this error:
[code]
ERROR 2010-09-23 13:33:56,747 (org.directwebremoting.util.CommonsLoggingOutput.error:75) - A request has been denied as a potential CSRF attack.
ERROR 2010-09-23 13:34:16,700 (org.directwebremoting.util.CommonsLoggingOutput.error:75) - A request has been denied as a potential CSRF attack.
ERROR 2010-09-23 13:34:16,950 (org.directwebremoting.util.CommonsLoggingOutput.error:75) - A request has been denied as a potential CSRF attack.
ERROR 2010-09-23 13:34:16,950 (org.directwebremoting.util.CommonsLoggingOutput.error:75) - A request has been denied as a potential CSRF attack.
ERROR 2010-09-23 13:34:16,950 (org.directwebremoting.util.CommonsLoggingOutput.error:75) - A request has been denied as a potential CSRF attack.
[/code]
"Mango error.jpg" is a print screen
In "log.zip" you will find all Tomcat logs files

Thanks for any help

CRL

Re:Session Error / A request has been denied as a potential CSRF attack.

SteveE — GMT

Try adding the following parameter setting to the dwr-invoker servlet settings in ...\WEB-INF\web.xml:

dwr-invoker
...
<-
crossDomainSessionSecurity <-
false <-
<-
...

Re:Session Error / A request has been denied as a potential CSRF attack.

SteveE — GMT

(Without the '<-' at the end of those lines, of course; those were meant to indicate the new entry in the file.)

Re:Session Error / A request has been denied as a potential CSRF attack.

reycyril — GMT

Yes, this solve the problem.

By the way, I notice that the solution was provided in less than 2 hour. I never been accustomed on having so quick support by major automation solution providers...

So Congratulation SteveE.

Regards

Cyril

Re:Session Error / A request has been denied as a potential CSRF attack.

SteveE — GMT

Thanks, Cyril. Glad I could help. BTW, I'm a Mango user like you. I just happened to run across this same issue a few weeks back.