Publishing does not adhere to valid.urls property

(Doc ID 2199722.1)

Last updated on FEBRUARY 12, 2018

Applies to:

Oracle WebCenter Sites - Version and later
Information in this document applies to any platform.


The default setup for a fresh fresh WCS installation configures "valid.urls" to go through the Web Tier (e.g. http://staging:80/sites). With this setup , one cannot login using the managed server's internal port (e.g. http://staging:7010/sites) since CAS rejects the login (and it is logged a "CASXSSFilter received non-trusted url" error), but one can do using the web tier URL. That is fine and expected.

But another WCS environment (e.g. development) can successfully publish to this installation using the managed server's port in the publishing destination's setup (e.g. using http://staging:7010/sites). The destination setup is green and publishing a single asset works. The target environment only has recorded the "web tier " URL (e.g. http://staging:80/sites/*).

Is this an expected behavior or a product defect, since it looks like publishing is bypassing this CASXSSFilter restriction?


Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms