3.5.1 Referer Filtering

The Referer Filtering process can be described as follows:

1. The LiveCycle server checks the HTTP method used for invocation:

   1. If it is POST, the LiveCycle server performs the Referer header check.

   2. If it is GET, the LiveCycle server bypasses the Referer check, unless CSRF_CHECK_GETS is set to true, in which case it performs the Referer header check. CSRF_CHECK_GETS is specified in the web.xml file for your application.

2. The LiveCycle server checks whether the requested URI is whitelisted:

   1. If the URI is whitelisted, the server accepts the request.

   2. If the requested URI is not whitelisted, the server retrieves the Referer of the request.

3. If there is a Referer in the request, the server checks whether it is an Allowed Referer. If it is allowed, the server checks for a Referer Exception:

   1. If it is an exception, the request is blocked.

   2. If it is not an exception, the request is passed.

4. If there is no Referer in the request, the server checks whether a Null Referer is allowed:

   1. If a Null Referer is allowed, the request is passed.

   2. If a Null Referer is not allowed, the server checks whether the requested URI is an exception for the Null Referer and handles the request accordingly.

The following depicts the CSRF check that LiveCycle performs when a request is sent to the server.

 Twitter™ and Facebook posts are not covered under the terms of Creative Commons.