Cross Site Action detected!

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3
Author Message
mac913
DD-WRT Guru


Joined: 02 May 2008
Posts: 1622
Location: Canada

PostPosted: Wed Dec 10, 2014 22:41    Post subject: Reply with quote
I ran into this "Cross Site Action detected!" message in Opera v12.14 after upgrading my spare R7000 to build 25580.

Under Edit Site Preferences, I selected "Send Referrer Information" and that fixed the message.

I didn't have this issue in the past or with the build 25090.

No issues with IE11.

_________________
Home Network on Telus PureFibre - 10GbE Copper Backbone
2x R7800 - Gateway & WiFi & 3xWireGuard - DDWRT r46329 Std
R7000 - Wired ISP 4K IPTV Gateway - DDWRT r44483 Std

Off Site 1

R7000 - Gateway & WiFi & WireGuard - DDWRT r44483 Std
WRT610Nv1 - Client Bridge - DDWRT r33679 Mega K2.4

Off Site 2

R7000 - Gateway & WiFi - DDWRT r44483 Std
E2000 - Wired ISP IPTV PVR Blocker - DDWRT r35531


YAMon 3.4.6 | DNSCrypt-Proxy V2
Sponsor
cookieboyeli
DD-WRT User


Joined: 25 Apr 2014
Posts: 61

PostPosted: Sun Aug 09, 2015 9:22    Post subject: Reply with quote
I'm getting this error in Cyberfox 39.0.3. As far as I know there is no "edit site preferences" to select anything in.

Is this an issue with browsers or DD-WRT?

AC66U 27453 6/25/15
Jack82
DD-WRT User


Joined: 26 Jan 2015
Posts: 229

PostPosted: Sun Aug 09, 2015 11:31    Post subject: Reply with quote
Upgrade to a newer build , e.g. 27506.
Fira
DD-WRT Novice


Joined: 14 Mar 2016
Posts: 1

PostPosted: Mon Mar 14, 2016 22:39    Post subject: How I solved the issue in my situation Reply with quote
tipstir wrote:
400 Bad Request
Cross Site Action detected!


Pink background


I had this issue with my setup. Unfortunately my issue was not rectifiable by a firmware update as there is only 1 firmware version for my router. Crying or Very sad

I have registered on this site just to pass on the solution that worked in my situation.

I triggered this issue not only because I decided to make a DNS name for my router's IP, but also because I decided to reverse proxy my router's homepage via Apache out to the internet (on a different URL)....

Obviously I had triggered the cross site scripting security, as that was pretty much exactly what I was doing.

DD-WRT picked up that the headers in my requests were not correct for the router, so it denied the request with an error 400.

Since my proxy was set with Apache, I had a rewrite rule in place already.

I had to add a little bit extra to the rewrite rule to make it all work : ProxyPreserveHost On and RequestHeader unset referer

Code:
<VirtualHost *:80>
ServerName my.server.com
DocumentRoot "/var/www/my.server.com/"
RequestHeader unset referer
ProxyPreserveHost On
ProxyPass / http://ADDRESS/
ProxyPassReverse / http://ADDRESS/
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
</VirtualHost>


Prior to that, I got the bad requests.

Obviously, I had tried a few different ways to solve it before I got to this solution. Some solutions got past the 400 error, but broke the CSS in the process.

This way ensured that my browser not only didn't get a 400 error, but all the CSS loaded correctly too (reverse proxies and relative links do not like each other it seems!)

Just chipping in my 2 cents worth!

Peace! Smile[/b]
markran
DD-WRT Novice


Joined: 18 Jul 2016
Posts: 9

PostPosted: Sat Oct 22, 2016 23:26    Post subject: "Connection was reset" Reply with quote
DD-WRT "Connection was reset" error in Firefox

or DD-WRT "Cross site action detected" error in Firefox

or DD-WRT "400 Bad Request" error in Firefox

while Save / Saving or Apply / Applying in Setup / Settings but it works in Chrome or Internet Explorer it may be because your Firefox browser is not sending Referrer Headers properly. DD-WRT strictly checks the headers for security reasons. Here's how I fixed it:

* The Firefox config setting "Network.http.sendRefererHeader" was set to "0" instead of the default which is "2". To change this type "about:config" into the Firefox address bar, then search on "Network.http.sendRefererHeader". Right-click to change.

* Other Firefox add-ons related to Privacy, Stealth, Headers or Referrers can also cause this problem. Try disabling them or try "Help -> Restart with Add-ons disabled"
marcelogreat
DD-WRT Novice


Joined: 29 Jan 2016
Posts: 5

PostPosted: Sun Jul 23, 2017 19:01    Post subject: USE SAFARI Reply with quote
Use Safari to get rid of that error
BriC
DD-WRT Novice


Joined: 18 Sep 2016
Posts: 2

PostPosted: Thu Jan 25, 2018 2:53    Post subject: Reply with quote
another year on in the zombie thread but...

I resolved this issue by including:

rel="noreferrer"

in my link. And now it works.

thanks to...
https://stackoverflow.com/questions/906304/how-to-not-send-a-referrer-from-a-link-in-html
slice1900
DD-WRT User


Joined: 18 Feb 2013
Posts: 99

PostPosted: Thu Jan 25, 2018 9:12    Post subject: Reply with quote
The real fix is to add "no_crossdetect=1" into your NVRAM. Why that is not a DD-WRT default I have no idea!
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2613
Location: Indy

PostPosted: Thu Jan 25, 2018 16:10    Post subject: Reply with quote
slice1900 wrote:
The real fix is to add "no_crossdetect=1" into your NVRAM. Why that is not a DD-WRT default I have no idea!
Thanks for that info; this is what BS said about it...
BrainSlayer wrote:
this feature is introduced in r14962. to prevent bad configs, i will not implement it as gui configurable feature
http://svn.dd-wrt.com/ticket/1483#comment:1

That means anyone needing this and running 14929 (or 14896, which nobody should be using) or older builds, needs to update to at least (Peacock recommended) build 15962. Which was the issue here, in fact.

_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
x64 OPNsense 20.7.6|FT2020.6: EA6900v1.1@1GHz, F7D8302@532|DD 45036: DIR-810L, WNDR4500v2 & 4000@533,
R6300v1, RT-N66U@663, E1500@353, WRT54G{Lv1.1,Sv6}@250
|OpenWRT 19.7.5: RT-ACRH13, R6220, WNDR3700v4
DWolfman
DD-WRT Novice


Joined: 09 Aug 2008
Posts: 31

PostPosted: Sun Jun 16, 2019 13:18    Post subject: Reply with quote
Seems this may not be working for the Netgear R6300v2 build 38840. I have no_crossdetect set to 1 in NVRAM, but it still pops the error page when I go through my link.

I know this is not current, but it was stable for this router. It originally was a Charter-firmware router that I went through steps to reset it's board ID to make it a non-Charter version, and load the normal Netgear firmware. I know it's had some stability issues in the past, and considered changing it back, but build 38840 has been rock solid on it and I didn't want to give that up just yet.

I do know this worked on a previous dd-wrt build, just don't remember which one.

Anyway, seems we still have to keep an eye on this functionality so we can keep the router working the way we want it to. And now I'm off to figure out what build to try next. Sad
DWolfman
DD-WRT Novice


Joined: 09 Aug 2008
Posts: 31

PostPosted: Sat Sep 21, 2019 18:59    Post subject: Reply with quote
Still not working on 40009. Need to get the latest and see if that works, then I'm going to either re-open the bug or enter a new one. This is one annoyance I could do without. Sad
DWolfman
DD-WRT Novice


Joined: 09 Aug 2008
Posts: 31

PostPosted: Sat Sep 21, 2019 19:30    Post subject: Reply with quote
Hmm, this was odd, but it is working now.

I loaded 41075 on my R6300v2. Did not reset the settings as I've rarely had issues with that. Everything else seems working fine.

But, it initially was still blocking with the cross site action block. The carried over settings from 40009 had the no_crossdetect already set to 1.

So I set it to 0, rebooted, and verified it still blocked me. Then set it to 1 and rebooted, now it is working. I no longer get the block and go straight to the router pages, like it should.

I didn't change anything else in the config across the reboots after 41075 was loaded. Just the no_crossdetect setting was changed.

It's possible this was not broken for as long as I thought it was, but I do recall earlier this year (before my June post in this thread) that I did a clean setup on another R6300v2 with the same build as this router and it didn't work there either.

Oh well, this build looks stable and the no_crossdetect is working, so I'm good. Smile

Others that can't get this to work, you might try setting no_crossdetect to 0, reboot, then set to 1 and reboot again. Might make it work for you.
fra.iesus
DD-WRT Novice


Joined: 21 Mar 2021
Posts: 1

PostPosted: Sun Mar 21, 2021 0:29    Post subject: Reply with quote
for those, who have the same issue accessing DD-WRT machine from another website: I'm using ref="noopener noreferrer" in the links to avoid it (I have a network map located on one local webserver with clickable objects on it and this workaround serves well).
Goto page Previous  1, 2, 3 Display posts from previous:    Page 3 of 3
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum