What is "IBI_CSRF_REFERER_MATCH_DOMAIN"?

[Asuka Tsuda]

I found "IBI_CSRF_REFERER_MATCH_DOMAIN" in event.log in WebFOCUS 9.0.4.

[2023-08-29 00:00:59,505] INFO [com.ibi.monitor.WFContextListener:ApplicationValues] - Application config parameter: IBI_CSRF_REFERER_MATCH_DOMAIN (WFConfigVarList), value=TRUE

What does this parameter mean?

[Patrick Huebgen]

This is one of the CSFR settings - https://en.wikipedia.org/wiki/Cross-site_request_forgery

Please check the security manual for more details

https://docs.tibco.com/emp/wf-wf/9.0.4/doc/pdf/TIB_wfwf_9.0.3_security_administration.pdf?id=11

[Asuka Tsuda]

Thanks for the quick response.

I looked at THE SECURITY MANUAL and found a description of the following settings, but no mention of "IBI_CSRF_REFERER_MATCH_DOMAIN".

・IBI_CSRF_ENFORCE

・IBI_CSRF_TOKEN_NAME

・IBI_CSRF_ALLOW_LEGACY

I know Cross-site request forgery.

What is the effect of enabling "IBI_CSRF_REFERERER_MATCH_DOMAIN"?

What is the difference between the above three settings?

In addition, is there a way to disable it?

Best regards,

Asuka Tsuda

[Patrick Huebgen]

This seems to be a setting that is not yet documented - please open a case - I do not see the setting / warning on my system.

Is this part of your webfocus.cfg?

[Asuka Tsuda]

I'm sorry for my late of reply.

I have opened a new case about this question.

Thank you for your help.