The site is housed in a Sub-Domain as a staging area for building until the site is done. What causes the CCRF attempt?
-
☆ A M B ☆
- 24,524 Posts
As described in the thread linked to above, it’s your browser not sending the expected referrer information in its request header.
-
☆ A M B ☆
- 24,524 Posts
Did you read the posts in the thread linked above?
That worked . . . thank you. I got in but now on the configuration of the MODx admin I am getting this error . . .
The configuration setting Validate HTTP_REFERER headers? is Off. We recommend turning it On.
What should I do about that?
thanks,
Daniel
-
☆ A M B ☆
- 24,524 Posts
Now, now... patience. I spent years RTFM before I was able to actually understand them.
While turning off the referer header check will allow the page to load, it does cause that security warning. For that reason as well as the security vulnerability being warned about, it’s not really the best solution. Changing your browser settings, or your firewall/proxy settings to include the referer headers in the requests is the best way. If you’re behind a corporate firewall and cannot change its settings, you’ll just have to live with the warning. If you have no other option, you can remove the security warnings from the Welcome page by editing the assets/templates/manager/welcome.html file and commenting out the section that generates the security warning tab.
