How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

(0) Share

Report

Posted on by MDeeb

Hi All,

we have a client that did a test and found the below outputs and want us to fix them before going live, any D365FFO on-premises security expert may help us on the below output especially the Cross-Site Request Forgery

Finding	Severity
Cross-Site Request Forgery	Moderate
Missing or insecure "X-XSS-Protection" header	Low
Missing or insecure Cross-Frame Scripting Defense	Low
Older TLS Version is Supported	Low
SHA-1 cipher suites were detected	Low

I have the same question (0)

All responses (6)

Answers (1)

nmaenpaa 101,160 Moderator on at

Like (0)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Did your customer share any more details about their analysis than this list? Perhaps if we could see how they came into that conclusion it would be easier to comment on it.

Was this reply helpful? Yes No
MDeeb 90 on at

Like (0)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Thank you nikolaos,

no they only shared this table with us.

Regards,

Was this reply helpful? Yes No
nmaenpaa 101,160 Moderator on at

Like (0)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Then I suggest asking them for more details. You want to know what the problem is before you start solving it.

Was this reply helpful? Yes No
Verified answer

nmaenpaa 101,160 Moderator on at

Like (1)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Also please remember that you can't control the architecture of D365FO itself - so if these comments are related to the application itself, how it handles logins, sessions and security, there's not much you or your customer can do.

And if they have hard requirements on such areas, they should actually evaluate them before choosing the ERP system, not just before golive :)

Was this reply helpful? Yes No
MDeeb 90 on at

Like (0)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Thank you Nikolaos,

i've asked the client for details and will revert back once i get them.

Thanks a lot.

Was this reply helpful? Yes No
MDeeb 90 on at

Like (1)

Report

RE: How to prevent Cross-Site Request Forgery on D365FF0 on-premises that is exposed over the internet ?

Thanks Nikolaos,

The customer has agreed on it.

Thanks for your usual help.

Was this reply helpful? Yes No