search

signalpoint / DrupalGap

An application development kit for Drupal websites.
https://www.drupalgap.org
GNU General Public License v2.0
232 stars 185 forks source link

Cross-site request forgery protection locks drupalgap connection #1005

Closed jsbriantes closed 6 years ago

jsbriantes commented 6 years ago

I have installed Security Kit module and It has checked (by default) HTTP origin in "Cross-site request forgery" section. With this configuration, Drupalgap can't connect from a device (or emulator), and I get "403 -forbbiden" error in console log (also an error on drupal system log about It's been locking ?=drupalgap/system/connect.json).
This problem happens only when I run the App with a device (Galaxy S5) or android emulator. If I run as web-app in browser, I works good. If I unchek this options, the app runs well from the device. Is there any solution to have this security option enabled? Thanks.

signalpoint commented 6 years ago

@jsbriantes This may have to do with the cordova white list plugin. Have you tried configuring that to allow connection to your site from the app?

I'm not familiar with the Security Kit module, so I don't know for sure. I do have a Galazy S5 though ;)

jsbriantes commented 6 years ago

Thanks. I'll review cordova whilelist plugin.