CSRF Guard 4.1.3 - invalid session when used with apache and weblogic server, particularly on Browser Edge in IE 11 Mode

[vikrantvij1]

We have recently migrated to the CSRF 4.1.3 from older version 3.1.0 , After having this implemented , we have started facing error specifically on Edge browser over IE-11 Mode.

We are using apache server beneath weblogic server, we are not able to figure out the real root cause, but reverting back CSRF guard to older version 3.1.0 fixed this.

Important Note - It is happening through Third party application interaction with our application and third party application is using IFRAME, We only have this issue in the EDGE in IE-11 mode , but working on all other browsers. Moreover, On first request everything looks fine and our application page loads in IFRAME, But on second request , the cookie which browser sent does not match the server session ID as cookie sent by browser on second request is different from the initial one, which results in invalid session error. Nevertheless, Reverting back to older CSRF Guard fix everything.

Few questions striking my mind here are -

1. Does CSRF guard 4.1.3 have a support for IE-11 or EDGE in IE-11 Mode ?
2. Is there any property to handle this in CSRF guard ?
3. Is this happening due to apache server configuration ?. which should not be the case because older version is working fine on same apache.
4. Any other possibility or suggestion?

We love to hear back on this and will definitely appreciate any kind of help or suggestions.

[forgedhallpass]

Hello @vikrantvij1,

• When you did the upgrade, have you also made sure to use the new csrfguard.js file?
• Do you have any errors in Edge's JavaScript console?
• Do you have any errors in the server logs (the new version uses SLF4J, hence you need to have an implementation on the classpath for it to work. Check out the test application in this project for more info).
• Have you tried debugging?

You haven't provided enough information for me to come up with a better educated guess, or to be able to reproduce/debug/troubleshoot the problem.

p.s.:

1. There is no 4.1.13 version, but 4.1.3, and the latest version is 4.1.4.
2. Internet Explorer reached end of life in June, hence there will be no official support for this scenario.