title: javax.servlet.ServletException: Possible CSRF attack. Refer header :
body: <p>I am using two WSO2 Identity Server for back-end and Apache HTTP as front-end Load Balancer</p>
  
  <p>When testing the browser the URL <a href="https://lab1.xx.xx/dashboard" rel="nofollow">https://lab1.xx.xx/dashboard</a>, I see the following error at the WSO2 console log: </p>
  
  <pre><code>TID: [0] [IS] [2015-09-10 16:59:22,846] ERROR {org.wso2.carbon.tomcat.ext.valves.CompositeValve} -  Could not handle request: /portal/gadgets/user_profile/js/main.js {org.wso2.carbon.tomcat.ext.valves.CompositeValve}
  javax.servlet.ServletException: Possible CSRF attack. Refer header : https://lab1.xx.xx/dashboard/
          at org.wso2.carbon.ui.valve.CSRFValve.validateRefererHeader(CSRFValve.java:123)
          at org.wso2.carbon.ui.valve.CSRFValve.validatePatterns(CSRFValve.java:96)
          at org.wso2.carbon.ui.valve.CSRFValve.invoke(CSRFValve.java:71)
          at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:178)
          at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
          at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
          at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
          at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:141)
          at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:156)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
          at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:52)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
          at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1736)
          at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1695)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
          at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
          at java.lang.Thread.run(Thread.java:745)
  </code></pre>
  
  <p>I applied the Patch ID: WSO2-CARBON-PATCH-4.2.0-1256 and WSO2-IS-5.0.0-SP01</p>
  
  <pre><code>    &lt;CSRFPreventionConfig&gt;
              &lt;Enabled&gt;true&lt;/Enabled&gt;
              &lt;Rule&gt;allow&lt;/Rule&gt;
  
              &lt;Patterns&gt;
                      &lt;Pattern&gt;carbon&lt;/Pattern&gt;
                      &lt;Pattern&gt;commonauth&lt;/Pattern&gt;
                      &lt;Pattern&gt;samlsso&lt;/Pattern&gt;
                      &lt;Pattern&gt;authenticationendpoint&lt;/Pattern&gt;
                      &lt;Pattern&gt;wso2&lt;/Pattern&gt;
                      &lt;Pattern&gt;oauth2&lt;/Pattern&gt;
                      &lt;Pattern&gt;openid&lt;/Pattern&gt;
                      &lt;Pattern&gt;openidserver&lt;/Pattern&gt;
                      &lt;Pattern&gt;passivests&lt;/Pattern&gt;
                      &lt;Pattern&gt;services&lt;/Pattern&gt;
              &lt;/Patterns&gt;
  
              &lt;WhiteList&gt;
                      &lt;Url&gt;https://localhost:9443&lt;/Url&gt;
              &lt;/WhiteList&gt;
      &lt;/CSRFPreventionConfig&gt;
  </code></pre>
  
  <p>Any hint how to setup a CSRF Whitelist?</p>
  
  <p>Regards, Raybar</p>