Re: CSRF errors after upgrade of tomcat 8

2015-12-16 Thread Mark Thomas
On 16/12/2015 02:41, Baron Fujimoto wrote: > On Tue, Dec 15, 2015 at 09:37:45AM +0200, Violeta Georgieva wrote: >> mapperContextRootRedirectEnabled and >> mapperDirectoryRedirectEnabled >> >> are attributes of the Context so your context.xml should look like the one >> below: >> >> > mapperDirec

Re: CSRF errors after upgrade of tomcat 8

2015-12-15 Thread Baron Fujimoto
On Tue, Dec 15, 2015 at 09:37:45AM +0200, Violeta Georgieva wrote: >Hello, > >2015-12-15 4:35 GMT+02:00 Baron Fujimoto : >> >> On Mon, Dec 14, 2015 at 09:12:20PM +, Mark Thomas wrote: >> >On 14/12/2015 20:49, Baron Fujimoto wrote: >> >> On Fri, Dec 11, 2015 at 05:02:43PM -1000, Baron Fujimoto w

Re: CSRF errors after upgrade of tomcat 8

2015-12-14 Thread Violeta Georgieva
Hello, 2015-12-15 4:35 GMT+02:00 Baron Fujimoto : > > On Mon, Dec 14, 2015 at 09:12:20PM +, Mark Thomas wrote: > >On 14/12/2015 20:49, Baron Fujimoto wrote: > >> On Fri, Dec 11, 2015 at 05:02:43PM -1000, Baron Fujimoto wrote: > >>> On Sat, Dec 12, 2015 at 12:16:01AM +, Mark Thomas wrote: >

Re: CSRF errors after upgrade of tomcat 8

2015-12-14 Thread Baron Fujimoto
On Mon, Dec 14, 2015 at 09:12:20PM +, Mark Thomas wrote: >On 14/12/2015 20:49, Baron Fujimoto wrote: >> On Fri, Dec 11, 2015 at 05:02:43PM -1000, Baron Fujimoto wrote: >>> On Sat, Dec 12, 2015 at 12:16:01AM +, Mark Thomas wrote: > > > >>> I've confirmed that the problem begins with 8.0.29.

Re: CSRF errors after upgrade of tomcat 8

2015-12-14 Thread Mark Thomas
On 14/12/2015 20:49, Baron Fujimoto wrote: > On Fri, Dec 11, 2015 at 05:02:43PM -1000, Baron Fujimoto wrote: >> On Sat, Dec 12, 2015 at 12:16:01AM +, Mark Thomas wrote: >> I've confirmed that the problem begins with 8.0.29. Looking through the changelog it is hard to see how any of the chan

Re: CSRF errors after upgrade of tomcat 8

2015-12-14 Thread Baron Fujimoto
On Fri, Dec 11, 2015 at 05:02:43PM -1000, Baron Fujimoto wrote: >On Sat, Dec 12, 2015 at 12:16:01AM +, Mark Thomas wrote: >>On 12/12/2015 00:01, Baron Fujimoto wrote: >>> >>> On Fri, Dec 11, 2015 at 09:25:12PM +, Mark Thomas wrote: On 11/12/2015 21:10, Baron Fujimoto wrote: > Afte

Re: CSRF errors after upgrade of tomcat 8

2015-12-11 Thread Baron Fujimoto
On Sat, Dec 12, 2015 at 12:16:01AM +, Mark Thomas wrote: >On 12/12/2015 00:01, Baron Fujimoto wrote: >> >> On Fri, Dec 11, 2015 at 09:25:12PM +, Mark Thomas wrote: >>> On 11/12/2015 21:10, Baron Fujimoto wrote: After upgrading Tomcat from 8.0.24 to 8.0.30, one of our applications

Re: CSRF errors after upgrade of tomcat 8

2015-12-11 Thread Mark Thomas
On 12/12/2015 00:01, Baron Fujimoto wrote: > > On Fri, Dec 11, 2015 at 09:25:12PM +, Mark Thomas wrote: >> On 11/12/2015 21:10, Baron Fujimoto wrote: >>> After upgrading Tomcat from 8.0.24 to 8.0.30, one of our applications >>> (Internet2's Grouper) "broke" with CSRF errors. Research turned up

Re: CSRF errors after upgrade of tomcat 8

2015-12-11 Thread Baron Fujimoto
On Fri, Dec 11, 2015 at 09:25:12PM +, Mark Thomas wrote: >On 11/12/2015 21:10, Baron Fujimoto wrote: >> After upgrading Tomcat from 8.0.24 to 8.0.30, one of our applications >> (Internet2's Grouper) "broke" with CSRF errors. Research turned up the >> following in the Tomcat8 Changelog: >> >>

Re: CSRF errors after upgrade of tomcat 8

2015-12-11 Thread Mark Thomas
On 11/12/2015 21:10, Baron Fujimoto wrote: > After upgrading Tomcat from 8.0.24 to 8.0.30, one of our applications > (Internet2's Grouper) "broke" with CSRF errors. Research turned up the > following in the Tomcat8 Changelog: > > "Add a new RestCsrfPreventionFilter that provides basic CSRF protect

CSRF errors after upgrade of tomcat 8

2015-12-11 Thread Baron Fujimoto
After upgrading Tomcat from 8.0.24 to 8.0.30, one of our applications (Internet2's Grouper) "broke" with CSRF errors. Research turned up the following in the Tomcat8 Changelog: "Add a new RestCsrfPreventionFilter that provides basic CSRF protection for REST APIs." However, Grouper already incorpo