Configuring XSRF Protection
Confluence has XSRF protection enabled by default. For example, the XSRF token must be sent on comment creation, to prevent users from being tricked into unintentionally submitting malicious data. All the themes bundled with Confluence have been designed to use this feature. However, if you are using a custom theme that does not support this security feature, you can disable it. Currently, we permit disabling the XSRF check solely for the endpoint used to add comments.
Please carefully consider the security risks before you disable XSRF protection for comments in your Confluence installation.
Read more about XSRF (Cross Site Request Forgery) at cgisecurity.com.
To configure XSRF protection for comments:
- Select Administration
, then select General Configuration - Select Security Configuration in the left-hand panel.
- Select Edit.
- Uncheck the Adding Comments checkbox in the XSRF Protection section, to disable XSRF protection.
- Select Save.
Last modified on Dec 6, 2024
Powered by Confluence and Scroll Viewport.