Enabling interim fix JR55834

JR55834 enhances token-based CSRF protection on REST APIs when cookies are used for authentication and the corresponding WCToken and WCTrustedToken parameters are not provided.

Before you begin

Install the interim fix for JR55834.
For information about how to install an interim fix, see

About this task

A new configuration AuthTokenEnabled is created, which you can set in the wc-component.xml file.

The new configuration determines whether the WCAuthToken HTTP header field is required for DELETE/PUT/POST calls when cookies are used for authentication. Its value must be equal to the authToken request attribute that is set by the store runtime.

Procedure

  1. Create a custom foundation component configuration file (wc-component.xml), if one does not exist.
    For more information about how to create a custom configuration file, see Changing properties in the component configuration file.
    Note:
    • The default component configuration file for the foundation component is WCDE_installdir/workspace/WC/xml/config/com.ibm.commerce.foundation/wc-component.xml
    • The custom component configuration file for the foundation component should be WCDE_installdir/workspace/WC/xml/config/com.ibm.commerce.foundation-ext/wc-component.xml

      To change the value of an existing property in a WebSphere Commerce component configuration file, you must create a customized version of the file in this location. The customized version of the file must contain only the changed properties.

  2. In your extended configuration, add the AuthToeknEnabled property to the REST configgroup.
    For example, 
    <_config:configgrouping name="REST">
	<!--
		Determines if the WCAuthToken HTTP header field is required for DELETE/PUT/POST calls when cookies are used for authentication.
		Its value must be equal to the authToken request attribute set by the store runtime.
	-->
	<_config:property name="AuthTokenEnabled" value="false"/>
</_config:configgrouping>
  3. Save and close the extended configuration file.
  4. Test your configuration changes.
  5. Deploy your changes to the production environment.