IT38285: DISABLING CSRF HEADER MIGHT IMPACT GUI ACTIONS

APAR status

• Closed as program error.

Error description

• In DataPower there can be some issue's particularly with the
  MGMT actions such as a backup or a config save done through the
  WEBGUI when the "disable-csrf" header is enabled.
  
  
  The issue's typically result in the MGMT action failing, the
  user being logged out, and the default logs writing an error of
  "VERIFIED FAILURE MGMT_ACTION".
  

Local fix

• Enable CSRF - "web-mgmt;no disable-csrf;exit"
  

Problem summary

• In DataPower there can be some issue's particularly with the
  MGMT actions such as a backup or a config save done through the
  WEBGUI when the "disable-csrf" header is enabled
  

Problem conclusion

• Fix is available in 2018.4.1.19, 10.0.1.6, 10.0.4.0
  
  For a list of the latest fix packs available, please see:
  http://www-01.ibm.com/support/docview.wss?uid=swg21237631
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels