URL sharing

URL sharing

book

Article ID: KB0071344

calendar_today

Updated On:

Products Versions
TIBCO DataSynapse GridServer 7.0.0

Description

When we try to share the URL of the Service Session Admin page where we search by session ID or other criteria and it's not showing the expected result. When a user follows the shared link it opens the default page saying "Welcome, admin. You are logged into the Manager".  
This issue occurs only when we disabled the XSSFilter and CSRF filter from the security tab

Steps to reproduce the issue:-
1.) Make sure XSSFilter & CSRF filter are enabled.
2.) Run the Linpack test, and search for a session.
3.) Copy the URL from the browser's address bar and open a new tab and paste the URL.
4.) The user sees the welcome page, instead of the session.
5.) Disable XSSFilter & CSRF filter and the searched session can be seen.

Expected results:-
As it is not a different domain in URL (not cross scripting) So expected behavior is to work without disabling XSSFilter & CSRF filter

Issue/Introduction

Share the URL of the Service Session Admin page by searching with session ID or other criteria without disabling XSSFilter & CSRF filter

Environment

Windows/Linux JDK

Resolution

Pre-requisites:
Installed JDK
Gridserver  7.x
Gridserver Engine
Install Gridserver
Step 1:
Navigate to Installation Directory>> datasynapse >>manager>>webapps>>livecluster>>WEB-INF>>config>>xss.xml
Step 2:
Add Following Block Code within <csrfURLs> block : 
<url>/livecluster/(admin|manage)/job/jobView2.jsp</url>
<url>/livecluster/(admin|manage)/control/job/jobAdmin.jsp</url>
Snapshot for reference:


Please refer xss.xml from attachment
Step 3:
Restart The server.
Now User Can share the link for Search Results by any criteria and View Service Session 

**Make sure User/Admin Logged in into the Application in the current browser where the shared link being opened

Attachments

URL sharing get_app