Documented: improves security.properties documentation
@@ -156,14 +156,17 @@ security.token.key=security.token.key
# -- no spaces after commas,no wildcard, can be extended of course...
host-headers-allowed=localhost,127.0.0.1,demo-trunk.ofbiz.apache.org,demo-stable.ofbiz.apache.org,demo-old.ofbiz.apache.org
-# -- By default the SameSite value in SameSiteFilter is 'strict'. This property allows to change to 'lax' if needed
-# -- If you use 'lax' we recommend that you set org.apache.ofbiz.security.CsrfDefenseStrategy for csrf.defense.strategy (see below)
+# -- By default the SameSite value in SameSiteFilter is 'strict'.
+# -- This property allows to change to 'lax' if needed.
+# -- If you use 'lax' we recommend that you set
+# -- org.apache.ofbiz.security.CsrfDefenseStrategy
+# -- for csrf.defense.strategy (see below)
SameSiteCookieAttribute=
# -- The cache size for the Tokens Maps that stores the CSRF tokens.
# -- RemoveEldestEntry is used when it's get above csrf.cache.size
# -- Default is 5000
-# -- TODO: separate tokenMap from partyTokenMap
+# -- TODO: possibly separate tokenMap size from partyTokenMap size
csrf.cache.size=
# -- Parameter name for CSRF token. Default is "csrf" if not specified
@@ -177,6 +180,8 @@ csrf.entity.request.limit=
# -- CSRF defense strategy.
# -- Because OFBiz OOTB also sets the SameSite attribute to 'strict' for all cookies,
+# -- which is an effective CSRF defense,
# -- default is org.apache.ofbiz.security.NoCsrfDefenseStrategy if not specified.
-# -- Use org.apache.ofbiz.security.CsrfDefenseStrategy if you want to use a 'lax' for SameSiteCookieAttribute
+# -- Use org.apache.ofbiz.security.CsrfDefenseStrategy
+# -- if you need to use a 'lax' for SameSiteCookieAttribute
csrf.defense.strategy=
