Liferay Session extend (/c/portal/extend_session) - HTTP 403 Forbidden
I am facing 403 Forbidden exceptions whenever /c/portal/expire_session or /c/portal/extend_session (and some others) are invoked. This happens regularly even when no user is logged in (since the guest user also retains a session).
I switched off automatic session extension in Liferay on purpose (session.timeout.auto.extend=false, session.timeout.redirect.on.expire=true).
I am using Liferay 6.2 CE GA5 bundled with Tomcat 8.5. It is more or less a plain setup (no extra filters, just some custom portlets and hooks).
MS Edge Developer console:
HTTP403: FORBIDDEN - The server understood the request, but is refusing to fulfill it. (XHR)POST - https://xxxxx:8443/c/portal/expire_session
Tomcat access logs:
[21/Nov/2018:09:23:54 +0100] "POST /c/portal/expire_session HTTP/1.1" 403 -
Tomcat connector:
<Connector
URIEncoding="UTF-8"
connectionTimeout="20000"
maxPostSize="20971520"
port="8443"
protocol="HTTP/1.1"
scheme="https"
server="May the eHealth Solutions be with you"
secure="true"
SSLEnabled="true"
SSLVerifyClient="none"
SSLProtocol="TLSv1.2"
SSLCertificateFile="${catalina.home}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.home}/conf/localhost.key"
SSLCACertificateFile="${catalina.home}/conf/localhost.crt"
SSLHonorCipherOrder="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
</Connector>
Any ideas and suggestions highly welcome!
Thx and Cheers
Stefan
tomcat liferay liferay-6 tomcat8
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
add a comment |
I am facing 403 Forbidden exceptions whenever /c/portal/expire_session or /c/portal/extend_session (and some others) are invoked. This happens regularly even when no user is logged in (since the guest user also retains a session).
I switched off automatic session extension in Liferay on purpose (session.timeout.auto.extend=false, session.timeout.redirect.on.expire=true).
I am using Liferay 6.2 CE GA5 bundled with Tomcat 8.5. It is more or less a plain setup (no extra filters, just some custom portlets and hooks).
MS Edge Developer console:
HTTP403: FORBIDDEN - The server understood the request, but is refusing to fulfill it. (XHR)POST - https://xxxxx:8443/c/portal/expire_session
Tomcat access logs:
[21/Nov/2018:09:23:54 +0100] "POST /c/portal/expire_session HTTP/1.1" 403 -
Tomcat connector:
<Connector
URIEncoding="UTF-8"
connectionTimeout="20000"
maxPostSize="20971520"
port="8443"
protocol="HTTP/1.1"
scheme="https"
server="May the eHealth Solutions be with you"
secure="true"
SSLEnabled="true"
SSLVerifyClient="none"
SSLProtocol="TLSv1.2"
SSLCertificateFile="${catalina.home}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.home}/conf/localhost.key"
SSLCACertificateFile="${catalina.home}/conf/localhost.crt"
SSLHonorCipherOrder="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
</Connector>
Any ideas and suggestions highly welcome!
Thx and Cheers
Stefan
tomcat liferay liferay-6 tomcat8
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
add a comment |
I am facing 403 Forbidden exceptions whenever /c/portal/expire_session or /c/portal/extend_session (and some others) are invoked. This happens regularly even when no user is logged in (since the guest user also retains a session).
I switched off automatic session extension in Liferay on purpose (session.timeout.auto.extend=false, session.timeout.redirect.on.expire=true).
I am using Liferay 6.2 CE GA5 bundled with Tomcat 8.5. It is more or less a plain setup (no extra filters, just some custom portlets and hooks).
MS Edge Developer console:
HTTP403: FORBIDDEN - The server understood the request, but is refusing to fulfill it. (XHR)POST - https://xxxxx:8443/c/portal/expire_session
Tomcat access logs:
[21/Nov/2018:09:23:54 +0100] "POST /c/portal/expire_session HTTP/1.1" 403 -
Tomcat connector:
<Connector
URIEncoding="UTF-8"
connectionTimeout="20000"
maxPostSize="20971520"
port="8443"
protocol="HTTP/1.1"
scheme="https"
server="May the eHealth Solutions be with you"
secure="true"
SSLEnabled="true"
SSLVerifyClient="none"
SSLProtocol="TLSv1.2"
SSLCertificateFile="${catalina.home}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.home}/conf/localhost.key"
SSLCACertificateFile="${catalina.home}/conf/localhost.crt"
SSLHonorCipherOrder="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
</Connector>
Any ideas and suggestions highly welcome!
Thx and Cheers
Stefan
tomcat liferay liferay-6 tomcat8
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
I am facing 403 Forbidden exceptions whenever /c/portal/expire_session or /c/portal/extend_session (and some others) are invoked. This happens regularly even when no user is logged in (since the guest user also retains a session).
I switched off automatic session extension in Liferay on purpose (session.timeout.auto.extend=false, session.timeout.redirect.on.expire=true).
I am using Liferay 6.2 CE GA5 bundled with Tomcat 8.5. It is more or less a plain setup (no extra filters, just some custom portlets and hooks).
MS Edge Developer console:
HTTP403: FORBIDDEN - The server understood the request, but is refusing to fulfill it. (XHR)POST - https://xxxxx:8443/c/portal/expire_session
Tomcat access logs:
[21/Nov/2018:09:23:54 +0100] "POST /c/portal/expire_session HTTP/1.1" 403 -
Tomcat connector:
<Connector
URIEncoding="UTF-8"
connectionTimeout="20000"
maxPostSize="20971520"
port="8443"
protocol="HTTP/1.1"
scheme="https"
server="May the eHealth Solutions be with you"
secure="true"
SSLEnabled="true"
SSLVerifyClient="none"
SSLProtocol="TLSv1.2"
SSLCertificateFile="${catalina.home}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.home}/conf/localhost.key"
SSLCACertificateFile="${catalina.home}/conf/localhost.crt"
SSLHonorCipherOrder="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
</Connector>
Any ideas and suggestions highly welcome!
Thx and Cheers
Stefan
tomcat liferay liferay-6 tomcat8
tomcat liferay liferay-6 tomcat8
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
edited Nov 22 '18 at 8:55
oberbics
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
asked Nov 21 '18 at 8:43
oberbicsoberbics
375310
375310
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Just because I hate unanswered questions:
The Problem was a CORS Filter which checked correctly for Content-Type within the request headers.
Liferay's AUI requests do not set this header (funny thing: Its only missing in MS Edge - Could not figure out why yet).
What I do now is setting the header in the prototype of AUI.IO like so:
AUI().IO.prototype._headers = {'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'text/plain;charset=UTF-8'};
Now, the request is not filtered out any more by the CORS filter.
Cheers
Stefan
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53408164%2fliferay-session-extend-c-portal-extend-session-http-403-forbidden%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Just because I hate unanswered questions:
The Problem was a CORS Filter which checked correctly for Content-Type within the request headers.
Liferay's AUI requests do not set this header (funny thing: Its only missing in MS Edge - Could not figure out why yet).
What I do now is setting the header in the prototype of AUI.IO like so:
AUI().IO.prototype._headers = {'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'text/plain;charset=UTF-8'};
Now, the request is not filtered out any more by the CORS filter.
Cheers
Stefan
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
add a comment |
Just because I hate unanswered questions:
The Problem was a CORS Filter which checked correctly for Content-Type within the request headers.
Liferay's AUI requests do not set this header (funny thing: Its only missing in MS Edge - Could not figure out why yet).
What I do now is setting the header in the prototype of AUI.IO like so:
AUI().IO.prototype._headers = {'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'text/plain;charset=UTF-8'};
Now, the request is not filtered out any more by the CORS filter.
Cheers
Stefan
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
add a comment |
Just because I hate unanswered questions:
The Problem was a CORS Filter which checked correctly for Content-Type within the request headers.
Liferay's AUI requests do not set this header (funny thing: Its only missing in MS Edge - Could not figure out why yet).
What I do now is setting the header in the prototype of AUI.IO like so:
AUI().IO.prototype._headers = {'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'text/plain;charset=UTF-8'};
Now, the request is not filtered out any more by the CORS filter.
Cheers
Stefan
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
Just because I hate unanswered questions:
The Problem was a CORS Filter which checked correctly for Content-Type within the request headers.
Liferay's AUI requests do not set this header (funny thing: Its only missing in MS Edge - Could not figure out why yet).
What I do now is setting the header in the prototype of AUI.IO like so:
AUI().IO.prototype._headers = {'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'text/plain;charset=UTF-8'};
Now, the request is not filtered out any more by the CORS filter.
Cheers
Stefan
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
answered Dec 5 '18 at 13:27
oberbicsoberbics
375310
375310
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53408164%2fliferay-session-extend-c-portal-extend-session-http-403-forbidden%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
