Firewalls may remove the Ajax verification token header

// Prior to invoking the response's commands, verify that they can be // trusted by checking for a response header. See // \Drupal\Core\EventSubscriber\AjaxResponseSubscriber for details. // - Empty responses are harmless so can bypass verification. This // avoids an alert message for server-generated no-op responses that // skip Ajax rendering. // - Ajax objects with trusted URLs (e.g., ones defined server-side via // #ajax) can bypass header verification. This is especially useful // for Ajax with multipart forms. Because IFRAME transport is used, // the response headers cannot be accessed for verification. if (response !== null && !drupalSettings.ajaxTrustedUrl[ajax.url]) { if (xmlhttprequest.getResponseHeader('X-Drupal-Ajax-Token') !== '1') { var customMessage = Drupal.t("The response failed verification so will not be processed."); return ajax.error(xmlhttprequest, ajax.url, customMessage); } }

Uncaught AjaxError: An AJAX HTTP error occurred. HTTP Result Code: 200 Debugging information follows. Path: /d8/admin/structure/views/ajax/display/viewstest/page_1/row StatusText: OK CustomMessage: The response failed verification so will not be processed.

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment almost 2 years ago →
needs-review-queue-bot
The Needs Review Queue Bot → tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.
Status changed to Postponed: needs info almost 2 years ago4:21am 13 February 2023
Comment almost 2 years ago →
🇦🇺Australia acbramley
3 years without much activity tells me this isn't a major. There's also quite a few headers in play now that will break things if stripped (e.g embedded content via media library)

I'm inclined to mark this as won't fix but would like to see what others think.
Comment almost 2 years ago →
🇬🇧United Kingdom longwave UK
I am inclined to agree, given that most reports of this were back in 2016, and it seems to affect HTTP only. This only affects authenticated users and most sites should be on HTTPS especially where authenticated users are involved, so this is perhaps still technically an issue, but only in a configuration that is not really recommended. Let's leave this open for a few more months and then close if there are no further reports.
Status changed to Closed: outdated about 1 year ago9:13am 7 November 2023
Comment about 1 year ago →
🇳🇿New Zealand quietone
Based on the comments in #50 and #51 I am closing this issue as outdated. If this is incorrect reopen the issue, by setting the status to 'Active', and add a comment explaining what still needs to be done.

Thanks!

Firewalls may remove the Ajax verification token header

Problem/Motivation

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comments & Activities