Area: JumpToServlet and ContentCreator ForwardAction

Redirections in the client-server communication are restricted by the FirstSpirit server for security reasons.

Using the optional parameter allowedRedirectHosts URLs can be defined to which a redirect is to be allowed.

The ContentCreator supports Local Network Access (LNA) in preview. Access to internal network addresses can be configured for selected hostnames via the parameter webedit.preview.allowLocalNetworkAccess.

allowedRedirectHosts

At some points in FirstSpirit, redirect URLs are generated (e.g. links from remote projects in the preview or for the ContentCreator preview) that can potentially also refer to external URLs; for example:

http://localhost:5100/jump?url=http://www.example.de

or

http://localhost:5100/fs5webedit/Dispatcher?project=1183078&language=
DE&weAction=Forward&forward=http://www.example.de

URLs can be defined using the optional parameter allowedRedirectHosts to which a redirect is to be allowed. The following modes are possible:

allowedRedirectHosts=ALLOW_ALL               
Redirects to all URLs are allowed without limitations.

allowedRedirectHosts=fs.mywebsite.de,example.de,intranet.mywebsite.de
This allows for the creation of a white list of allowed targets. The allowed URLs are specified as comma-separated:

allowedRedirectHosts=FS_SERVER
A white list of allowed URLs is created from the following sources:                                

1. fs-server.conf, parameters
   • URL
   • JNLP_SERVLET_URL       
   • WEBAPP_ROOT_URL
   • WEBAPP_WEBEDIT5_URL
   • WEBAPP_WEBMON_URL
   • WEBAPP_STAGING_URL
   • WEBAPP_PREVIEW_URL
   • preview.externalDeliveryURL
2. in the server properties configured web server (see Web server). This is the default setting.  

If an attempt is made to call an URL that is not allowed, the HTTP status code 403 (with the error cause “Forbidden request host:”) is output.

webedit.preview.allowLocalNetworkAccess

Chromium-based browsers (Chrome, Edge from version 142) by default block requests from embedded frames to private or internal network addresses (Local Network Access). This parameter allows configuring a comma-separated list of hostnames for which access to the local network is permitted from the ContentCreator preview.

Similar to the parameter allowedRedirectHosts, wildcards can be used.

By default, the parameter is not set and Local Network Access is deactivated.

Example:

webedit.preview.allowLocalNetworkAccess=*.example.com,localhost      

Specification and Background:

• WICG — Local Network Access: https://wicg.github.io/local-network-access/
• W3C — Permissions Policy: https://www.w3.org/TR/permissions-policy/

Security Notice: Activating this will disable an intentionally implemented browser protection mechanism for the affected preview domains. If a preview application or a third-party resource integrated there is compromised, there is a possibility that internal network services could be accessed from the editor's browser.

Using wildcards to configure redirect URLs

Wild-card characters can be used for configuration purposes. These wild-cards can be used for the top subdomain as well as within a subdomain.

Examples for possible wild-cards:

*.example.com 

first*.example.com 

*spirit.example.com 

f*spirit.example.com 

firstspirit.*xample.com 

Not allowed are:

• Wild-cards in IP addresses
• multiple wild-cards inside a single definition
• replacing a whole domain with a wildcard

Examples for prohibited definitions:

*.168.1.1 

f*spir*.example.com 

firstspirit.*.com 

*.com 

*