Unwanted CSRF validation on Liferay 7.3 LoginPortlet

Question

After a user performs a login using the portal LoginPortlet the login does not succeed and a WARN was printed to the log:

User 0 is not allowed to access URL http://localhost:8080/web/guest/login and portlet com_liferay_login_web_portlet_LoginPortlet: User 0 did not provide a valid CSRF token for com.liferay.portlet.SecurityPortletContainerWrapper

After a second login afterwards, the login was ok. The issues only occurs if the login page was opened some minutes and the auth token gets invalidated. This is basically fine, but the portal config portlet.add.default.resource.check.whitelist has an exclude for LoginPortlet. But this whitelist seems not avoid the unwanted check. Are there any other places how the avoid CSRF checking for LoginPortlet?

Answer 1

I could not reproduce this issue, I used this server for testing:
Liferay Community Edition Portal 7.3.5 CE GA6

Here are my steps, please let me know what I should change to experience the issue:

1. I extracted this zip file to my ubuntu linux pc:
   liferay-ce-portal-tomcat-7.3.5-ga6-20200930172312275.tar.gz
   
2. Started the server and completed the 1st time setup
   
3. I re-started the server and visited localhost:8080 in an Opera browser
   
4. Waited 7 minutes
   
5. I clicked on "Sign in" in the upper right corner
   
6. Waited again 5 minutes
   
7. I entered my credentials
   
   Results:
   I could log on successfully, there were no errors about CSRF
   
   A couple of suggestions:
   
   A. Do a search for CSRF in:
   https://github.com/liferay/liferay-portal/blob/master/portal-impl/src/portal.properties
   and see if you can find a property that solves your issue
   Such properties can be:
   auth.token.impl=com.liferay.portal.security.auth.SessionAuthToken
   auth.token.check.enabled=false
   auth.token.ignore.origins
   
   B. Maybe you can try to set up something like this in your portal-ext.properties:
   portlet.add.default.resource.check.whitelist.actions=/login/login
   
   C. You can do a search in Liferay Jira, for example this ticket talks about something similar:
   https://issues.liferay.com/browse/LPS-129976