503 error with csrfguard jar

[Ryan Karolak]

Hi,

I am installing the OWASP CSRFGuard on our website, but upon updating the web.xml I am running into a 503 error.

I found the following error in the log:


####<Apr 10, 2012 2:03:14 PM EDT> <Error> <HTTP> <DHKCCFYWDEVWC> <DHKCCFYWDEVWC> <Main Thread> <<WLS Kernel>> <> <BEA-101163> <Could not load user defined listener: org.owasp.csrfguard.CsrfGuardServletContextListener
java.lang.ClassNotFoundException: org.owasp.csrfguard.CsrfGuardServletContextListener
at weblogic.utils.classloaders.GenericClassLoader.findClass(Ljava/lang/String;)Ljava/lang/Class;(GenericClassLoader.java:199)
at weblogic.utils.classloaders.ChangeAwareClassLoader.findClass(Ljava/lang/String;)Ljava/lang/Class;(ChangeAwareClassLoader.java:61)
at java.lang.ClassLoader.loadClass(Ljava/lang/String;Z)Ljava/lang/Class;(Unknown Source)
at java.lang.ClassLoader.loadClass(Ljava/lang/String;)Ljava/lang/Class;(Unknown Source)
at weblogic.utils.classloaders.GenericClassLoader.loadClass(Ljava/lang/String;)Ljava/lang/Class;(GenericClassLoader.java:224)

I have however, placed the owasp.csrfguard.jar in the lib folder.

The information I have added to web.xml is the folowing:

<display-name>ClarifyCRM eApplication</display-name>
	<context-param>
		<param-name>Owasp.CsrfGuard.Config</param-name>
		<param-value>WEB-INF/Owasp.CsrfGuard.properties</param-value>
	</context-param>
	<context-param>
		<param-name>Owasp.CsrfGuard.Config.Print</param-name>
		<param-value>true</param-value>
	</context-param>
	<filter>
		<filter-name>CSRFGuard</filter-name>
		<filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>CSRFGuard</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<listener>
		<listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
	</listener>
	<listener>
		<listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
	</listener>

I'm not quite sure where I am going wrong. I am rather new to Weblogic however.

Any help would be appreciated.

Thanks!

[sudipto shekhar]

Ryan Karolak wrote:Hi,


I have however, placed the owasp.csrfguard.jar in the lib folder.

You said you have placed the jar in the lib folder but it did not help..

Did you try including the jar in the class path?

[sudipto shekhar]

And Ryan,

A very warm welcome to JavaRanch !

[Ryan Karolak]

sudipto shekhar wrote:

Ryan Karolak wrote:Hi,


I have however, placed the owasp.csrfguard.jar in the lib folder.

You said you have placed the jar in the lib folder but it did not help..

Did you try including the jar in the class path?


And Ryan,

A very warm welcome to JavaRanch !

Thanks!

I did miss adding it to the startweblogic.cmd file. I added it and it seems to relieve the error in the log before, but upon going to the site after it's back up, I still get the same 503 error. Is there another place that this needs to be added to or is there something simple that I am overlooking?

set CLASSPATH=%WEBLOGIC_CLASSPATH%;%CLASSPATH%;C:\ClarifyCRM13.1\eSupport\Clarify\ClfyeSupport.war\WEB-INF\lib\sbjapi10.jar;C:\ClarifyCRM13.1\eSupport\Clarify\ClfyeSupport.war\WEB-INF\lib\ssjdbc50.jar;C:\ClarifyCRM13.1\eSupport\Clarify\ClfyeSupport.war\WEB-INF\lib\Owasp.CsrfGuard.jar

Thank you.

[sudipto shekhar]

Can you see this jar added in the classpath when the server starts?

How did you verify that this jar is in the classpath?

In-order to do so, go through the output text of startWeblogic script in the logs to verify if this jar is being picked up.

Also please see the OWASP CSRFGuard installation guide for more information.

Revert with your findings..

[Ryan Karolak]

sudipto shekhar wrote:Can you see this jar added in the classpath when the server starts?

How did you verify that this jar is in the classpath?

In-order to do so, go through the output text of startWeblogic script in the logs to verify if this jar is being picked up.

Also please see the OWASP CSRFGuard installation guide for more information.

Revert with your findings..

It sees it. This is from the [server_name].log under D:\Bea\user_projects\domains\peaktest\[server_name]

<[ServletContext(id=6770133,name=ClfyeSupport,context-path=/)]: Deployment descriptor "jar:file:D:\Bea\user_projects\domains\peaktest\.\DHKCCFYWDEVWC\.wlnotdelete\extract\DHKCCFYWDEVWC_eSupport_ClfyeSupport\jarfiles\WEB-INF\lib\Owasp.CsrfGuard_20120412_1444.jar!/META-INF/Owasp.CsrfGuard.tld" is malformed. Check against the DTD: cvc-elt.1: Cannot find the declaration of element 'taglib'. (line 30, column 196).>

Is there somewhere else I should be checking?

I did also follow the install guide... It didn't work, which is why I am coming here.