Skip to main content

ATG - how to prevent Cross-Site attacks using _dynSessConf parameter


Cross-site scripting attacks take advantage of a vulnerability that enables a malicious site to use your browser to submit form requests to another site.

In order to protect forms from cross-site attacks in ATG, you can enable form submissions to automatically supply the request parameter _dynSessConf, which identifies the current session through a randomly generated long number. On submission of a form (using dsp:form tag) or activation of a property setting (using dsp:a tag), the request-handling pipeline ( DAFDropletEventServlet ) validates _dynSessConf  against its session confirmation identifier. If it detects a mismatch or missing number, it can block form processing and return an error.

To disable this functionality, we could give the following properties (@ /atg/dynamo/Configuration to disable it globally)
enforceSessionConfirmation = false -->  specifies whether the request-handling pipeline requires session confirmation in order to process the request; the default value is true.
warnOnSessionConfirmationFailure = false --> specifies whether to issue a warning on a confirmation number mismatch; the default value is true.

You can control session confirmation for individual requests by setting the attribute requiresSessionConfirmation to true or false on the applicable dsp:form or dsp:a tag. If this attribute is set to false, the _dynSessConf parameter is not included in the HTTP request and the request-handling pipeline skips validation of this request’s session confirmation number.
Labels:

Comments

  1. Anonymous15 May 2014 at 00:53

    http://docs.oracle.com/cd/E24152_01/Platform.10-1/ATGBusCommRefGuide/html/s1402sessionexpirationfromlackofusera01.html

    Can we handle 409 conflict using CheckSessionExpiration?
    I tried this. But before reaching request to pipeline,web.xml redirect to url mention there.

    ReplyDelete

Post a Comment

Popular posts from this blog

ATG Search - how to define the search configuration rules

ATG Search configuration rules are specified through the ATG BCC Merchandising UI. Over here you could specify the below set of rules Redirection rules --> If you want to redirect to another page other than the search result page for a search keyword Property Prioritization rules  --> Prioritize certain set of properties and give weightage Result exclusion rules  --> Exclude certain search results Result positioning rules  --> Position / Sort the search result data 1.  To create the search configuration tree, you need to log-in to the ATG BCC Merchandising UI and select the Search Configuration Tree in the Browse tab drop down. Now need to click the Create button and first you need to create the Search Configuration Folder. 2.  When you create the folder, give the name of the folder and select whether the contents vary by Language or Segment. If your ecommerce site need to support more than one language and y...
6 comments
Read more

ATG License Files and Oracle Software Delivery Cloud

Oracle no longer generates license keys that are specific to your IP address(es). Oracle now provides generic license files that enable you to fully utilize all of the features for which you are licensed. Please find the ATG License files for different ATG versions @ http://www.oracle.com/us/support/licensecodes/atg/index. @ Oracle Software Delivery Cloud , you can find downloads for all licensable Oracle products –> https://edelivery.oracle.com/ Please find below a screen shot for ATG products download :
Post a Comment
Read more

ATG - basic concepts of ATG

This blog is for the ATG beginners to get some basic overview about ATG. I just given the ATG concepts as a list of numbered points for the ease of understanding. 1. At the framework level, ATG is a               java based application platform for hosting web-based applications, as well as RMI accessible business components,               with an ORM layer,               a component container,               an MVC framework,               and a set of tag libraries for JSP. 2. Art Technology Group(ATG)'s Dynamo Application Server (DAS) is a Java EE compliant application server. DAS is no longer actively developed as ATG recommends using other Java EE applications servers for its products such as BEA WebLogic, JBoss or IBM WebSphere. 3. Prior to ATG 2007, JHTML was used instead of JSP for view purpose. J...
4 comments
Read more

ATG - how to create and deploy a new atg module

ATG products are packaged as a number of separate application modules. Application modules exist in the ATG installation as a set of directories defined by a manifest file. To create a new module, follow the below steps : Create a module directory within your ATG installation.  Create a META-INF directory within the module directory. Note that this directory must be named META-INF.  Create a manifest file named MANIFEST.MF and include it in the META-INF directory for the module. The manifest contains the meta-data describing the module. A module located at <ATG2007.1dir>/MyModule is named MyModule and a module located at <ATG2007.1dir>/CustomModules/MyModule is named CustomModules.MyModule. Within the subdirectory that holds the module, any number of files may reside in any desired order. These files are the module resources (EAR files for J2EE applications, WAR files for web applications, EJB-JAR files for Enterprise JavaBeans, JAR files of Java class...
4 comments
Read more

ATG CA - BCC home screen : how to add a new link

          Activity source is the property which controls the links on the left nav on the BCC home screen. All activity sources are registered with the ActivityManager component at /atg/bizui/activity/ActivityManager . When rendering the BCC home page, the ActivityManager cycles through all the registered ActivitySource components and displays left navigation links for each of them on the BCC home page. For example if I want to add a new link "My New Link" , below screen shots exaplins how this can be done 1. Add  activityManager.properties to specify the activityresources. In this  activityManager, I specified one MyActivitySource. 2. Add  MyActivitySource.properties  to specify the name of the link and the other details . Here it refers to a bundle properties file.  3. Add  the bundle properties file  to specify the name of the link.  4. Now you could see the new link...
6 comments
Read more