New security check on external URLs

Last modified by Simon Urli on 2025/10/27 15:05

A new security mechanism related to URLs has been put in place in XWiki to inform users when they click on a link leading to an external URL that does not belong to the list of trusted domains. This mechanism is enabled by default only on links put on comments, but can be enabled for the whole wiki too. It reuses the list of trusted domains that can be configured in xwiki.properties, and a new configuration has also been provided to allow specifying specific URLs that can be accessed without any warning from the frontend. Finally it's possible to also disable the new security mechanism thanks to a dedicated configuration. 

#-# [Since 17.9.0]
#-# [Since 17.4.7]
#-# [Since 16.10.14]
#-# Define the policy to use for URL checks performed in the UI, whether the user should be asked for confirmation
#-# when going to an untrusted domain.
#-# Accepted values for this property are: enabled, disabled, or comments.
#-# Enabled means that the check will be enforced in all the wiki UI, disabled that the check will never be
#-# performed, and comments (default value) means that the check will only be performed on links provided in the
#-# comments of the wiki.
#-#
#-# By default this property is set to comments:
# url.frontendUrlCheckPolicy=comments

#-# [Since 17.9.0RC1]
#-# [Since 17.4.6]
#-# [Since 16.10.13]
#-# Allow to allow specific URLs to be accessible from the frontend without asking confirmation, and without
#-# needing to allow and entire domain. The expected format is absolute URLs separated by commas, e.g.:
#-# https://github.com/xwiki/xwiki-platform,https://www.xwiki.org/xwiki/bin/view/Main/WebHome
#-#
#-# By default this property is empty:
# url.allowedFrontendUrls=

Get Connected