InformAction Forums

I want to use a web application running in intranet (domain "example", without any toplevel domain), which uses OpenID and therefore should work together with xlogon.net. On start of a session, after feeding the OpenID username, NoScript reports into firefox' browser console: – stating my vainly attempt of a rule.

Please give some hints how to distill off suitable rules from the console report. I tried "Accept from LOCAL" – it doesn't work; "Accept from ALL" – it works, but to let pass from any isn't the goal of ABE, I think.

Opposed to the easy-to-update whitelisting I find managing ABE rules very awkward. In my opinion, while displaying a deny-message there should be the possibility to start some kind of assistent that proposes a rule to be inserted in ABE's ruleset.

Thanks – Peter

Hi,

the message suggest that a redirect is happening.
For an Accept action to apply to a redirect, both sites must be listed in the same "Accept ..." clause.
This should work: Notice, though, that the rule above is protecting xlongon.net against CSRF, which I'm not sure is exactly what you meant to do.

Giorgio Maone wrote:… in the same "Accept ..." clause.

Ok; important hint.

Giorgio Maone wrote:

Code: Select all

Accept from example .xlogon.net

What is the difference to

Giorgio Maone wrote:Notice, though, that the rule above is protecting xlongon.net against CSRF, which I'm not sure is exactly what you meant to do.

I thought, protecting against CSRF is in general a goal of ABE. I don't understand – about what do you want to warn?

Ciao – Peter

Peter0 wrote:

Giorgio Maone wrote:

Code: Select all

Accept from example .xlogon.net

What is the difference to

Code: Select all

Accept from example SELF

SELF matches only the exact "scheme://ho.st:port" of the origin site
.xlogon.net matches "xlogon.net" and all its subdomains regardless of scheme and port.

Peter0 wrote:

Giorgio Maone wrote:Notice, though, that the rule above is protecting xlongon.net against CSRF, which I'm not sure is exactly what you meant to do.

I thought, protecting against CSRF is in general a goal of ABE. I don't understand – about what do you want to warn?

I think he meant that your rule is protecting the whole xlogon.net domain - including www.xlogon.net, etc. Probably not what you intended.

You might be better off with instead.