freeipa

#8376 FreeIPA - Dogtag enableNonce=false, should be true
Opened by cipherboy. Modified

Open
Close Issue

Request for enhancement

As an admin, I want my Dogtag to use nonces for protection against CSRF and Reflected XSS. By disabling enableNonce, the CA will disable all nonce protection. This mostly affects certain CA operations, such as approving a certificate request.

This has been disabled since early commits: https://github.com/freeipa/freeipa/commit/8d164569d0e4ee79089ae224ac6f5a569c291cdb

We should look into enabling this again.

Issue

Nonce should be enabled by default.

Steps to Reproduce

  1. https://github.com/freeipa/freeipa/blob/master/ipaserver/install/cainstance.py#L411
    2.
    3.

Actual behavior

Nonces Disabled

Expected behavior

Nonces Enabled.

Version/Release/Distribution

current master

Additional info:

None

Relevant discussion and PR was opened in the past here: https://github.com/freeipa/freeipa/pull/4836

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.