I'm using struts2 framework running on tomcat 7.0.77.
In the common filter, I've added SameSite cookie with below code:
Cookie cookie = new Cookie("SameSite", "strict");
cookie.setMaxAge(-1);
res.addCookie(cookie);
I'm using latest version of Chrome (Version 60.0.3112.90 (Official Build) (64-bit)) to test if it can avoid CSRF.
Assume the server to be protected is 192.168.1.100. And the other server is running on 192.168.1.101, with a very simple test.html:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=
, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>Document</title>
</head>
<body>
Click me!
</body>
</html>
So, I open a Chrome tab and logged in 192.168.1.100.
Then I open another Chrome tab to access https://192.168.1.101/test.html and
click "Click me!".
What I'm expecting is that when the I click this "Click me!", the link redirects me to https://192.168.1.100/home.html but the cookies shouldn't be passed. So I need to login again.
but the actual fact is I'm still in logged in state and all the cookies are passed which I can see from Chrome Developer tools.
Really confused where I'm wrong, appreciate your help!
Finally spent a whole day to figure it out.
We need to understand SameSite as an option instead of a key.
So we need to set a cookie like this:
Cookie cookie = new Cookie("SomeKey", "SomeValue; SameSite=strict");
cookie.setMaxAge(-1);
res.addCookie(cookie);
Related
I am using laravel version 5.5.45 and trying to learn Blade for first time. I created a file views/layout/app.blade.php. And want to extend that app.blade.php file in views/contact.blade.php. I extended the master blade file using #yield.
Do I need to do any change in route folder?
views/layout/views/layout/app.blade.php
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>Document</title>
</head>
<body>
#yield('content')
#yield('footer')
</body>
</html>
views/contact.blade.php
#extends('layouts.app')
#section('content')
<h1>Contact Pafg</h1>
#endsection
When I hit the URL localhost/cms/public/contact I see the error in title.
You need to add custom route in web.php which is located in routes directory.
At the end of file add following code to connect the defined route to your view.
Route::get('contact', function () {
return view('contact');
});
Finally you can access it via localhost/contact
First of all you need to put the request to get view on browser. Now assuming that your project name: cms lets assume you are calling cms/contacts ( this is a get request just to get simple blade view ). Now this will go to web.php in routes directory, where you need to handle that request e.g.
Route::get('contact', function() {
return view('contact');
})
here assuming your contact.blade.php is in your resources/views/contacts.blade.php path. if it is within any another nested directory need to add that directory name e.g. return view('directory_name/contact');.
You can perform same action using controller method in which case you need to specify controller and method name in route file and return blade in that method. e.g.
Route::get('contact', 'controller#methodName');
To return blade you need to use view('blade_name') helper of laravel and you don't have to call you request like cms/public/contact, simply use cms/contact url.
Hope this helps.
I don't know why Facebook Share not getting value of og:image, og:title of my website while I inspect element I see everything correct.
This is facebook debug:
Attributes are inferred: The og:image attribute must be explicitly provided, even if it is possible to derive value from other tags.
Lack of assets
The following required assets are missing: og:url, og:type, og:title, og:image, og:description, fb:app_id.
Bad response code
URL returned a bad response response code
These are elements on my website
<meta property="og:url" content="http://vnlovepet.com/blog/huan-luyen-cho-alaska-nhu-the-nao-cho-dung-58">
<meta property="og:type" content="article" />
<meta property="og:title" content="Huấn luyện chó Alaska như thế nào cho đúng?">
<meta property="og:description" content="Huấn luyện chó Alasla là một trong những sở thích của nhiều người, nhưng họ lại chưa biết cách huấn luyện thế nào cho đúng.">
Have a look, how exactly Facebook's scraper sees your URL: https://developers.facebook.com/tools/debug/echo/?q=http%3A%2F%2Fvnlovepet.com%2Fblog%2Fhuan-luyen-cho-alaska-nhu-the-nao-cho-dung-58
There are errors dumped into HTML and that's the reason of your issue.
Need help understanding how opengraph works and how it relates to the "FB Like" button.
We do have opengraph meta tags deployed on all of the pages for our content. However
it looks like the only way to get "FB Like" button to work, is to run the URL thru the facebook linter.
If a user attempts to "Like" the page, that was never liked before, only the URL will be posted to the wall.
If the url is ran thru the linter, all the consecutive likes will work properly, by image, title and description will be pulled.
is it possible that the app_id is not linking properly with the pages?
having our FB Admin go and like all the content that is produced is not an option
http://www.nydailynews.com/life-style/travel/underwater-photos-amazing-shots-sea-gallery-1.1078782
<meta property="fb:app_id" content="366487756153">
<meta property="fb:admins" content="1594068001">
<meta property="og:site_name" content="NY Daily News">
<meta property="og:title" content="Mark Tipple's Underwater Project - Underwater photos: Amazing shots from under the sea">
<meta property="og:type" content="article">
<meta property="og:url" content="http://www.nydailynews.com/life-style/travel/underwater-photos-amazing-shots-sea-gallery-1.1078782">
<meta property="og:image" content="http://assets.nydailynews.com/polopoly_fs/1.1078770!/img/httpImage/image.jpg_gen/derivatives/searchthumbnail_75/image.jpg">
<meta property="og:description" content="Talented underwater photographer Mark Tipple, from Sydney, Australia, lies in wait for unsuspecting swimmers and surfers before snapping a perfect picture of them from beneath the waves.">
http://www.nydailynews.com/gossip/john-travolta-experienced-bed-passionate-hotel-romp-claims-masseur-luis-gonzalez-article-1.1079272
<meta property="fb:app_id" content="366487756153">
<meta property="fb:admins" content="1594068001">
<meta property="og:site_name" content="NY Daily News">
<meta property="og:title" content="John Travolta was 'a great kisser' and ‘very experienced’ in bed during passionate hotel romp, claims masseur Luis Gonzalez ">
<meta property="og:type" content="article">
<meta property="og:url" content="http://www.nydailynews.com/gossip/john-travolta-experienced-bed-passionate-hotel-romp-claims-masseur-luis-gonzalez-article-1.1079272">
<meta property="og:image" content="http://assets.nydailynews.com/polopoly_fs/1.1079279!/img/httpImage/image.jpg_gen/derivatives/searchthumbnail_75/image.jpg">
<meta property="og:description" content="Another hotel masseur is claiming sexual shenanigans on the part of John Travolta -- only this accuser says he welcomed the actor's horny horseplay and found him "very experienced" in bed.">
In order to get your page recognized as a custom open graph object you'll need to follow these steps.
Create a facebook app
Setup site domain, namespace etc...
Create a custom action and a custom object under app settings >> Open Graph: Getting Started (see this link for help)
After creating it, you'll see your object under object types in Open Graph Settings
Click on "Get Code" button to get the html tags
Update your page to show up the same html head & meta tags
Go to http://developers.facebook.com/tools/debug to test if you have setup everything right
P.S. Don't forget to hit correct answer if it works, or PM me for more help
Your URL isn't set to the application as noted in the linter,
Object at URL 'http://www.nydailynews.com/life-style/travel/underwater-photos-amazing-shots-sea-gallery-1.1078782' of type 'article' is invalid because the domain 'www.nydailynews.com' is not allowed for the specified application id '366487756153'. You can verify your configured 'App Domain' at https://developers.facebook.com/apps/366487756153.
Add the proper domain to your settings and it should work.
We've been trying to get the Like button to work with og:type = article since we are sharing photos. So far, if we use article, the post appears on the wall but the counts do not increment correctly.
If the user clicks like, before the comment box appears, the like count out at
https://api.facebook.com/method/fql.query?query=select+url,total_count,like_count,comment_count,share_count,click_count+from+link_stat+where+url=%27http%3A%2F%2Ftestenv.snap2twitter.com%2Fphotos%2F1829074%27&format=json
shows the like count incremented by one.
If the user enters a comment, however, the count is reset to 0!
If we change the og:type to "website", the counts work but ONLY if a user enters a comment (reverse problem). If they don't, nothing appears on the Wall or in the timeline but the Activity log shows the user Shared a link.
Our headers (for og:type=article) are:
<html lang="en" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://ogp.me/ns#" xmlns="http://www.w3.org/1999/xhtml">
<head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# article: http://ogp.me/ns/article#">
The og:tags are
<meta content="Love My Yellow Ferarri - Snap MyLife" property="og:title">
<meta content="Snap MyLife" property="og:site_name">
<meta content="article" property="og:type">
<meta content="<my app id>" property="fb:app_id">
<meta content="http://files-testenv.mobicious.com/files/2012/02/28/164634/1829078/new_large.jpg" property="og:image">
<meta content="http://testenv.snap2twitter.com/photos/1829078" property="og:url">
<meta content="Love My Yellow Ferarri" property="og:description">
Anyone have any ideas? Does anyone have the Like button working correctly with og:type=article?
TIA
hope this help you
News things about og:type = article
Live Example
Having never dealt with Facebook at a developer level, I'm sure that I'm doing something very obviously wrong here. Anyway, here's the problem:
I generate the like button code from https://developers.facebook.com/docs/reference/plugins/like/ and then copy it into my page. When I try to view the site I get nothing displaying.
I noticed that the url in the script section fails to include the protocol (it comes out with: "//connect.facebook.net/en_US/all.js#appId=207642302633270&xfbml=1"). When I have a look what's happening using Firebug I can see that it's inserting the script tag into the head section - but the URL doesn't work. I've tried modifying it to include "https:" as the protocol and I then see that the script gets loaded and that also it inserts a bunch of CSS into the head section.
But still nothing displays on the site.
The only thing I can think of that could be problematic is that I (or, more specifically, my client) doesn't have a Facebook company profile of any sort - I can ask them to set one up if required but this would not be the preferred option as they don't want to maintain a Facebook profile for the business.
Here's a stripped down sample I'm working with:
<html>
<head>
<title>Testing the Like Button</title>
<meta property="og:title" content="Company FB Test" />
<meta property="og:type" content="company" />
<meta property="og:url" content="http://www.domain.com/fb-test.html" />
<meta property="og:image" content="http://www.domain.com/logo.png" />
<meta property="og:site_name" content="Site Name" />
<meta property="fb:admins" content="__MY_FB_ID__" />
</head>
<body>
<script>(function(d){
var js, id = 'facebook-jssdk'; if (d.getElementById(id)) {return;}
js = d.createElement('script'); js.id = id; js.async = true;
js.src = "https://connect.facebook.net/en_US/all.js#appId=207642302633270&xfbml=1";
d.getElementsByTagName('head')[0].appendChild(js);
}(document));</script>
<div class="fb-like" data-send="false" data-layout="box_count" data-width="67" data-show-faces="false" data-font="arial"></div>
</body>
</html>
A couple of notes:
The sample includes the protocol "https:" - as mentioned, I've tried without as well.
This has been tested in the latest versions of Chrome 13, Firefox 6 and IE 9
I've tested this in Facebook Lint and it gives me no errors.
Thanks in advance to whoever succeeds in pointing out the obvious to me - and to anyone else who chimes in with any friendly advice.
Cheers,
Zac
You need to make sure to add this code somewhere in your page:
<div id="fb-root"></div>
You will see in the chrome debugger tool that there is an error saying it can't find that div.