AEM Forms - CSRF Token Verification | Community
Skip to main content
James_R_Green
James_R_Green
Level 6
Oct 24, 2018 1:30 PM UTC

AEM Forms - CSRF Token Verification

Hi,

I am interested in how the CSRF protection works in AEM Forms when submitting to a REST endpoint (custom sling servlet deployed to AEM).

I see that there is a ":cq_csrf_token" inserted when my form is submitted and I can see it is passed in the request.

1) Is this token automatically verified by AEM when POSTing to a rest endpoint - if so, how does it achieve this?

2) If this is not automatically verified what code would be needed within my rest endpoint in order to validate the csrf token is legitimate?

I have searched for this information but cannot find all of the details, can someone  point me in the right direction?

Thanks,

Jim

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

5 replies

smacdonald2008
smacdonald2008
Level 10
Oct 26, 2018 5:48 PM UTC

James - we asked the Forms team to respond to this question.

I know in Sites AEM - when you want to invoke a Sling Servlet - you use the AEM JQuery version. It includes a CSRF token.

Translate
James_R_Green
James_R_GreenAuthor
Level 6
Oct 27, 2018 2:56 PM UTC

Thanks smacdonald2008

Translate
    James_R_Green
    James_R_GreenAuthor
    Level 6
    Oct 25, 2018 8:16 AM UTC

    Hi,

    If I tamper with the CSRF token in the browser inspector, I get an error which suggests the token is verified automatically (option 1 in my original post). I can see from the error this happens here:

    guideContainer.af.internalsubmit.jsp HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter doFilter: the provided CSRF token is invalid

    guideContainer.af.internalsubmit.jsp HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter isValidRequest: not well formed CSRF token - rejecting

    Where is the code for internalsubmit.jsp? I cannot find it anywhere!

    Thanks,

    Jim

    Translate
    sudhansh
    sudhansh
    Employee
    Nov 20, 2018 7:31 AM UTC

    Hi James,

    The CSRF handling for Forms is quite similar, and the CSRF clientLib part of the forms runtime is responsible for passing the required token on submission. This token is validated as part of the CSRFFilter which you are seeing in the logs you shared.

    Thanks & Regards,

    -Sudhanshu

    Translate
    Terms & ConditionsAccessibility statement

    Loading footer...