[AMQ-7434] Enable Jolokia CORS strict-checking by default

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.16.0, 5.15.12
• Component/s: Web Console
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 03/Mar/20 14:21
• Updated: 03/Mar/20 14:49
• Resolved: 03/Mar/20 14:49

Description

By default, we should enable Jolokia CORS strict-checking by default. Otherwise the web console is potentially vulnerable to a CSRF style attack, as Jolokia allows all origins by default.

This change has a minor backwards compatibliity implication - a REST client must specify (some) Origin header in the request - and also calling from "localhost" in the browser won't work.

Issue Links

• links to: GitHub Pull Request #496