Site Search - Liferay Learn

This article documents the way to configure Liferay DXP 7.x as a Service Provider working with two SSO protocols (Okta using SAML 2.0 and Google OpenID Connect). The basic configuration can be achieved within Liferay out of...

How to kill the session on browser (tab or window) close?

legacy Troubleshooting

Issue The user session should be terminated immediately if they close the browser tab or window. Environment DXP 7.0 + Resolution Liferay maintains the session of 30 minutes by default and Liferay doesn't provide any...

Reset Connection option is missing on the License page in DXP 7.3

legacy Troubleshooting

Issue The reset connection option is missing on the License page in DXP 7.3 which is available on the previous releases. Environment Liferay DXP 7.3 GA1 Resolution This is a known limitation of the product that might...

Disable password verification for SSO users

legacy How To

Issue When changing the screen name or email address of a user, the portal now requires a password verification. This was not a requirement for previous versions of Liferay. Environment DXP 7.3+ Resolution This is a...

I cannot create new Virtual Instance with error Screen name must not be null

legacy Troubleshooting

Issue When I try to create a new Virtual Instance, the portal displays the error "Your request failed to complete". The portal log shows the following error: ERROR [default...

Importing LDAP settings through osgi/config files does not import password

legacy

Issue LDAP settings can be imported into the Liferay environment using osgi/config files These settings are imported into System Settings, and can then be configured for an individual instance in Instance Settings When...

Content-Security-Policy Header Integration

legacy

Issue How can a CSP (content security policy) HTTP header that enables only specific external resources to be loaded in the frontend be implemented? Environment Liferay DXP 7.2 Resolution CSP is not currently...

HTTP Strict Transport Security (HSTS) Header Not Used

legacy How To

Issue The HSTS header cannot completely defend against man-in-the-middle attacks. However, it can be useful in defending against an attack in which an attacker establishes an encrypted connection to the application and...

Verbose Error Messages

legacy How To

Issue The name of the technologies used, such as Apache Coyote, Tomcat, etc. are visible. Environment Liferay DXP 7.2, DXP 7.3 Resolution Each application is responsible for allowing its information to be displayed...

Known Vulnerabilities with Liferay AntiSamy

legacy Troubleshooting

The following issue may compromise the security of your Liferay Digital Experience Platform implementation. Vulnerability Information The Liferay AntiSamy app depends on third party libraries that have known...

Avoid or allow that some applications can be dynamically displayed in a page

legacy How To

Issue The permissions system for an application (portlet) includes a security check when the application is going to be displayed in a page. Normally, the users should not be able to see applications if the...

Replacing NTLM SSO with Kerberos in Liferay Portal 6.2

legacy How To

Issue NTLM SSO protocol has some vulnerabilities addressed by Microsoft in CVE-2020-1472 (external link), forcing to use the secure RPC connection. See also How to manage the changes in Netlogon secure channel...

Unable to upload file bigger than 10MB with ClamAVSizeLimitException after enabling Antivirus

legacy Troubleshooting

Issue Unable to upload a file bigger than 10MB after enabling antivirus with the following error in the log 2021-07-19 08:35:43.476 ERROR [http-nio-8080-exec-9][PortletServlet:119] javax.portlet.PortletException:...

Known Vulnerabilities with Liferay Fjord Theme and 1975 London Theme

legacy Troubleshooting

The following issue may compromise the security of your Liferay Digital Experience Platform implementation. Vulnerability Information The Liferay Fjord Theme and Liferay 1975 London Theme depend on third party...

/c/ redirects to login page

legacy

Issue When the user tries to access the URL: 'http://localhost:8080/c/', even if the 'c' page doesn't exist, it redirects to the login page instead of a 404 page not found. Environment Liferay DXP [all versions]...

Log messages for Stored XSS vulnerabilities

legacy Troubleshooting

Issue We would like to know whether there are any strings to search for in log files, to check if any of the following vulnerabilities have been exploited in our environment? LSV-1237 / CVE-2023-42628 LSV-1236 /...

Can we obfuscate HTML of the sites?

legacy

Issue I would like to increase our protection from man in the middle attacks by obfuscating our site's HTML. Is there a method for this already implemented in Liferay? Environment DXP 7.0+ Resolution There is no...

Error "Invalid site key" when using reCAPTCHA v3

legacy Troubleshooting

Issue When configuring reCAPTCHA v3 and testing it on the "Forgot Password" page, the following error message is reported: "ERROR for site owner: Invalid site key". Environment Liferay DXP 7.2+ Resolution Liferay...

Error: Only known users are allowed to sign in using OpenID Connect.

legacy Troubleshooting

Issue You might encounter an error when using OpenID Connect, and users who are not yet been registered to Liferay are unable to login as they are identified as strangers. The error appears as the...

Search Results