JR61821: DOC - DESCRIPTION FOR SECURITY.CSRFPROTECTIONREFERERWHITELIST MISLEADING

APAR status

• Closed as documentation error.

Error description

• In "Security-hardening properties" (
  https://www.ibm.com/support/knowledgecenter/en/SS8JB4/com.ibm.wb
  pm.imuc.doc/topics/rsec_harden_properties.html ), the
  description for the Security.CsrfProtectionRefererWhitelist
  security hardening property is misleading:
  
  "The value of this property must be a comma-separated list of
  host names (or domain names) that are valid values for the
  Referer header field. By restricting values to host names and
  domain names that serve user interfaces for Business Automation
  Workflow, you can mitigate CSRF."
  
  The term "domain name" means the fully qualified host name
  including the domain. However, you might interpret it as the
  domain part of the host name. For example, if the full host name
  is "myserver.domain.com", you might incorrectly think it is
  sufficient to configure just "domain.com" as the value for the
  property.
  

Local fix

• n/a
  

Problem summary

• No additional information is available.
  

Problem conclusion

• The content will be updated the next time the documentation is
  refreshed.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels