Question & Answer
Question
We have a wiki page/document with hyper links to all our IBM InfoSphere MDM web applications like Inspector, Webreport etc. Previously we use to click the link and it would open a new browser session in the adjacent tab. But we recently upgraded and clicking on the hyperlink now, gives a 403 forbidden http error. If we refresh the same page, it reloads and we are presented with a login screen but the initial loading always results in that error. Why are we seeing this error and can we prevent it?
Cause
A 403 Forbidden HTTP status code is got in response to a request from a client for a resource to indicate that the server can be reached and understood the request, but refuses to take any further action. In this case, the request to load the login page was received by the application server (Apache or Websphere) from the application (inspector, web reports), but it was rejected by the application server.
It was rejected because this behavior (using hyper links to open new inspector sessions) is not supported in the newer versions of the product. In previous versions, one could click on a wiki link and have a session open but after thorough architectural review, we realized that this could result in a security vulnerability where malicious exploit of a different website could execute unauthorized commands in these web applications. Consider a case where the user has 2 tabs open, the page with a hyperlink and an internet site which has malicious code. The internet site could potentially execute commands in inspector if you allow transferring access from one tab to another. This vulnerability is known as "Cross-Site Request Forgery" and it exploits the trust that a site has in a user's browser.
To fix this, we revoked the trust established via HTTP headers between different browser tabs. In all newer releases and the MDS web apps no longer trust the user's browser session and after this fix, the requests from a different domain are forbidden. This design change leads to the observations mentioned in the above segment.
Answer
Being a security concern, this behavior is not configurable and the use case will always lead to the 403 forbidden error. You may update the wiki/document to advise the users to either copy the link and enter it in the address bar instead of simply clicking. If they have to click on the link, ignore the initial page load failure, and simply refresh the login page.
Product Synonym
MDS;Master Data Service;MDM;MDMSE;Master Data Management;IBM Infosphere Master Data Service;MDM Standard Edition;MDM Hybrid Edition;Initiate
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21668184