Background
Initial ticket:
| Jira Legacy | ||||||||
|---|---|---|---|---|---|---|---|---|
|
To prevent cross site data interception, 'Origin' header whitelist has been implemented for API queries
Technical Details
Whitelist can be configured in WMS Settings > PBX > Security
Settings are stored in /rw2/etc/pbx/http-security.conf
Different domains are supported for configuration e.g.
...
| Scroll export button | ||||||||
|---|---|---|---|---|---|---|---|---|
|
| Info |
|---|
This Admin Instruction explains how to configure domain whitelist to protect PBX from cross-site request forgery (CSRF) attacks. Created: April 2018 Updated: May 2024 Permalink: https://wildix.atlassian.net/wiki/x/dAvOAQ |
| Table of Contents |
|---|
| Warning |
|---|
IMPORTANT: Trusted domains must be added to a domain whitelist! Please note that any Web API / PBX API integration will stop working if the domain is not added. |
| Warning |
|---|
If you are using Firewalls, make sure the following pool of IP addresses is present in your Whitelist for access to Wildix microservices: 3.122.16.10 |
Introduction
The main purpose of adding domains to a whitelist is to protect PBX from cross-site request forgery (CSRF) attacks.
How it works:
Generally, web requests are restricted to only the current domain, per the same-origin policy. The same-origin policy is a significant security standard implemented by web browsers to prevent requests against a different origin (e.g., different domain) than the one from which it was served. At the same time, the same-origin policy also prevents legitimate interactions between a server and clients of a known and trusted origin.
To allow such interactions, Cross-origin resource sharing (CORS) is used. It is a standard that allows cross-domain requests. CORS can be defined as a set of headers that allow a browser and server to communicate about which requests are/ are not allowed. The simplest way is to check that the request originates from a trusted site, using Origin request header. For example,
| Code Block | ||
|---|---|---|
| ||
Origin: https://pbx_name.wildixin.com |
If a server decides that the request should be allowed, it sends Access-Control-Allow-Origin header with the same origin that was sent. For example,
| Code Block | ||
|---|---|---|
| ||
Access-Control-Allow-Origin: https://pbx_name.wildixin.com |
If this header is missing or the origins don’t match, then the request is not allowed. If origins match, then a browser processes the request.
Configuration of Domain Whitelist
Whitelist is configured in WMS -> PBX -> Security -> CORS.
To configure a domain whitelist:
Enter IP address/ domain name and click + to add the value:
Supported formats of IP address/ domain name:
- http://<domain or IP address> / https://domain or IP address>
- http://<domain or IP address>:port / https://<domain or IP address>:port
Examples:
- https://testpbx.wildixin.com/
- https://testpbx.wildixin.com:4443/
http://testpbx.wildixin.com/
It is also possible to add patterns using asterisk symbol "*" that replaces letters, numbers and dashes:
Examples:- https://*.wildixin.com
*://*.wildixin.com
https://*.*.wildixin.com
Note Note: IP range can't be specified in this case. You just need to enter one IP address.
Note Note: Wildix Portal "https://pbx.wildix.com
...
/" and Wildix Chrome Extension "https://chrome-extension://lobgohpoobpijgfegnlhdnppegdbomkn
...
" are hardcoded in the whitelist
...
During feature implementation following changes were made:
- closed the ability to receive answers in the iframe: set header 'X-Frame-Options' to 'DENY'
- closed cross domain query on Collaboration scripts:
- /collaboration/index.php
- /features/features_user.php
- opened all requests from Origin: 'https://pbxs.wildix.com'
- return an empty response to all requests api, if the Origin is not from the whitelist
Attention
...
, there is no need to add them.
After you enter all the values, click Save:
To delete the value from the list, click X.
| Note |
|---|
Note: Starting from WMS 6.04.20230803.1, whitelisting domain can also be used to allow access to files (call recordings, voicemails, faxes). See more in documentation How to download files via different authorization types and CORS domain whitelisting |
| Macrosuite divider macro | ||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| Button macro | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|