Repository navigation
WW-5754 Accept cross-site HEAD navigations in the Fetch Metadata policy - #2122
Merged
Merged
Conversation
…tadata policy The documented policy lists HEAD alongside GET as an accepted method for cross-site navigations; WW-5753 accepted GET only. Cross-site POST navigations stay rejected: allowing them would re-open classic form-POST CSRF. Endpoints receiving SAML/OIDC form_post or payment-gateway returns opt out per action with the fetchMetadata interceptor's "disabled" parameter. Replaces testValidTopLevelNavigation, which sent no Sec-Fetch-Site header and so never reached the navigation branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lukaszlenart
marked this pull request as ready for review
November 7, 2026 16:47
|
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes WW-5754
Summary
StrutsResourceIsolationPolicyaccepts cross-sitenavigaterequests forHEADas well asGET, matching the Fetch Metadata interceptor documentation ([GET, HEAD]).testValidTopLevelNavigation, which sent noSec-Fetch-Siteheader and so never reached the navigation branch, with a cross-site GET + HEAD navigation test.testCrossSiteNavigationWithUnsafeMethodRejectedis unchanged.Decision on cross-site POST navigations
WW-5754 listed two options. This PR takes option 2: cross-site POST navigations stay rejected, as introduced by WW-5753.
Accepting
navigatefor any method was rejected because a cross-site POST navigation is the classic form-CSRF request, andnavigateis also sent for<iframe>targets. Applications receiving SAML/OIDCform_postresponses or payment-gateway returns opt out per action:This is a behaviour change against 7.4.0 / 6.12.0 and goes into the 7.5.0 and 6.13.0 Version Notes and Migration Guide.
exemptedPathsis not a working alternative yet: it is matched against the context path rather than the request path, so it cannot exempt a single action. WW-5846, also targeted at 7.5.0 / 6.13.0, makes it match the request path (servlet path plus path info, exact match) in a separate PR. Once both land, the Migration Guide entry offers both opt-outs:exemptedPathsby path,fetchMetadata.disabledper action.Test plan
FetchMetadataInterceptorTest— HEAD case fails before the change, passes aftermvn test -DskipAssembly -pl core— 3743 tests, 0 failures🤖 Generated with Claude Code