# WebSocket  CSRF protection

Before the **Qlik Sense November 2024 release**, WebSockets **did not require CSRF protection**. However, in the **November 2024 update**, Qlik **extended CSRF protection to WebSocket connections** for enhanced security.

### **What Changed in November 2024?**

1. **WebSocket Requests Are Now Subject to CSRF Protection**
   * Previously, CSRF protection applied **only to HTTP API requests**.
   * Now, **WebSockets also require CSRF tokens** to prevent unauthorized cross-site requests.
2. **Stricter Browser Security Policies**
   * Some modern browsers, like Chrome and Edge, enforce **stricter cross-site WebSocket security**.
   * Without explicit **CORS headers** allowing credentials, the browser **blocks WebSocket connections**.
3. **Qlik Now Requires CSRF Token Handling for WebSockets**
   * When the Qommentary Admin Console **loads `require.js` from Qlik**, it initiates a WebSocket connection.
   * Qlik **expects a CSRF token**, but without the correct headers, your browser **blocks the connection**.

***

### **Why Are These Headers Required?**

| **Header**                                            | **Purpose**                                                                          |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------ |
| `Access-Control-Allow-Origin: http://qommentary:5006` | Allows the mashup (running in the browser) to access Qlik resources.                 |
| `Access-Control-Allow-Credentials: true`              | Ensures cookies (including session authentication) are sent with WebSocket requests. |
| `Access-Control-Expose-Headers: qlik-csrf-token`      | Allows the browser to read the CSRF token from the WebSocket response.               |

***

### **Why Didn’t You Need This Before?**

* **Pre-Nov 2024:**
  * WebSockets bypassed CSRF checks.
  * Qlik didn’t require CSRF tokens for WebSockets.
  * Your browser allowed the connection without extra headers.
* **Post-Nov 2024:**
  * Qlik enforces CSRF protection on **all WebSocket connections**.
  * The browser **rejects** WebSocket requests if the required headers are missing.

***

### **Solution**

To restore functionality, you must **manually allow cross-origin WebSocket requests** in Qlik Sense:

1. **Go to QMC → Virtual Proxy → Advanced Settings**.
2. **Add these headers under "Additional Response Headers":**

   ```
   Access-Control-Allow-Origin: http://qommentary:5006
   Access-Control-Allow-Credentials: true
   Access-Control-Expose-Headers: qlik-csrf-token
   ```
3. **Apply changes and restart Qlik services**.