topic Re: Web Stored Process blocked in Administration and Deployment

Web Stored Process blocked

_Ryan_ — Thu, 20 Feb 2020 21:33:15 GMT

I am attempting to run a stored process from an IIS server. However the process is blocked and the user sees the following error.

You attempted to access a SAS application by using the following URL:

http://servername.company.com:<port>/SASStoredProcess/do

The URL has been blocked because it came from an untrusted site, which might be attempting a malicious attack.

I have followed the following papers in followed the instructions from the SAS® 9.4 Administration Middle-Tier Administration Guide

How to Whitelist of Websites and Methods Allowed to Link to SAS Web Applications:

https://go.documentation.sas.com/?cdcId=bicdc&cdcVersion=9.4&docsetId=bimtag&docsetTarget=p1xtsni38p58t3n1ljd2fy4c3joz.htm&locale=en

My stored process has an address somewhat like http://myssitename.domainname.com/example_process.htm

In application management, configuration manager, SAS application infrastructure, I have the following settings.

sas.web.csrf.refers.allowNull	true
sas.web.csrf.refers.blacklist
sas.web.csrf.refers.knownHosts	http://mysitename.domainname.com/
sas.web.csrf.refers.performCheck	true
sas.web.csrf.refers.skipMethods
sas.web.navigation.knownHosts	http://mysitename.domainname.com/

So can anyone tell me why the user is still blocked from running the stored process?

Note: if i set performCheck to false, the stored process works and the user is prompted to logon to SAS and can run the stored process,

sas.web.csrf.refers.performCheck

false

That works...but that defeats the the purpose of the whitelist.

Re: Web Stored Process blocked

AnandVyas — Fri, 21 Feb 2020 01:57:49 GMT

After many attempt and per last response from SAS tech support I took out the trailing slash and 
only one entry and everything started to work. 
So it looks like if you are redirecting from a SAS URL you need to add the trailing slash 
but if you are redirecting from a different site in my case 
internal site you don't need the trailing slash.

Re: Web Stored Process blocked

_Ryan_ — Fri, 21 Feb 2020 19:10:32 GMT

Thanks Anand_V,

However in this case, removing the trailing slash did not help.

Still perplexed,

Ryan

Re: Web Stored Process blocked

AnandVyas — Sun, 23 Feb 2020 07:08:21 GMT

I would suggest you to raise a track with SAS Support by emailing them the error logs and changes tried at support@sas.com for faster resolution.