From f221072375f87c14b90b604545d6981d8df5b667 Mon Sep 17 00:00:00 2001
From: Colm O hEigeartaigh <coheigea@apache.org>
Date: Tue, 3 Mar 2020 14:22:04 +0000
Subject: [PATCH] AMQ-7434 - Enable Jolokia CORS strict-checking by default

---
 .../release/webapps/api/WEB-INF/classes/jolokia-access.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
index 09f29a494e..8cad1cd40e 100644
--- a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
+++ b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
@@ -17,6 +17,11 @@
 -->
 <restrict>
 
+  <!-- Enforce that an Origin/Referer header is present to prevent CSRF -->
+  <cors>
+    <strict-checking/>
+  </cors>
+
   <!-- deny calling operations or getting attributes from these mbeans -->
   <deny>
     <mbean>
@@ -31,4 +36,4 @@
     </mbean>
   </deny>
 
-</restrict>
\ No newline at end of file
+</restrict>