Qlik Sense Enterprise on Windows: Extended WebSocket CSRF protection

[Sonja_Bauernfeind]

Beginning with Qlik Sense Enterprise on Windows 2024, Qlik has extended CSRF protection to WebSockets. For reference, see the Release Notes.

In the case of mashups, extensions,and or other cross-site domain setups, the following two steps are necessary: 

1. Add additional response headers. These headers help protect against Cross-Site Forgery (CSRF) attacks.
2. Change the applicable code in your mashup or extension.

Content

• Add the Response Headers
• Adapt your Mashup or Extension code
• Workflow
• Verification

Add the Response Headers

The three additional response headers are:

Access-Control-Allow-Origin: https://localhost:8080
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: qlik-csrf-token

Localhost and port 8080 are examples. Replace them with the appropriate hostname. Defining the port is optional. 

If you have multiple origins, seperate them by comma.

Example:

For more information about adding response headers to the Qlik Sense Virtual proxy, see Creating a virtual proxy. Expand the Advanced section to access Additional response headers.

Adapt your Mashup or Extension code

In certain scenarios, the additional headers on the virtual proxy will not be enough and a code change is required. In these cases, you need to request the CSRF token and then send it forward when opening the session on the WebSocket. See Workflow for a visualisation of the process.

An example written in Enigma.js is available here:

• Authentication: Qlik Sense JSON Web Token (JWT) 
• Code Sample 

The information and example in this article are provided as-is and are not directly supported by Qlik Support. More assistance can be found on the Qlik Integration forum. Professional Services are available to help where needed.

Workflow

Workflow

Verification

To verify if the header information is correctly passed on, capture the web traffic in your browser's debug tool.

Environment

• Qlik Sense Enterprise on Windows November 2024 and later

[Tool_Tip]

Dear Sonja,

We are running November-2024 path 6 and we have already build some mashup as well, so just need to confirm if it is required us to add the mentioned Response headers ?

As if now by default I am unable to see any headers available:

[FabioSanchesRibeiro]

Hi @Tool_Tip, yes, this is a required parameter whenever you have the following scenarios: mashups, extensions, cross-site or external web server embedding Qlik Sense objects.

[ASpivey01]

Chrome browser does not allow multiple values for the Access-Control-Allow-Origin header:

This is making it impossible to serve mashups on different domains/subdomains using a single virtual proxy.

Is there any way around this?

[karthiksrqv]

@Sonja_Bauernfeind 

Please look into adding code sample for other authentication methods that Qlik has been supporting for a long time (like the one above for JWT).