403 forbidden for some of the POST operations | Community
Skip to main content
akhilat9657589
Level 2
Feb 21, 2018 10:55 AM UTC
Solved

403 forbidden for some of the POST operations

Hi,

For some of the POST operations, we are getting the response as 403 forbidden. This work fine when "POST" operation is removed from Apache Sling Referrer Filter.We have added the js <cq:includeClientLib categories="granite.csrf.standalone"/>. But still the response is 403.

When we checked the form data from the reqest the attribute :cq_csrf_token is missing in those ajax call which is getting failed. Have any one of you faced similar issue?

Please advice.

Thanks,

Akhila

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    akhilat9657589Accepted solution
    Level 2
    Feb 23, 2018 3:10 AM UTC

    Yes, we are using Jquery Ajax to perform the operation. Now we have fixed the issue by adding the token to the form data using jquery.

    View reply

    9 replies

    priyankabiswal-
    priyankabiswal-
    Level 2
    Feb 12, 2019 10:25 AM UTC

    Thanks! This resolves the issue!

    Translate
    pratekumar
    pratekumar
    Level 2
    Feb 23, 2018 5:21 AM UTC

    Hi Akhila

    We had the same issue. The CSRF token was not passed in the form POST. We included the cq.jquery in the head and it worked for us:

    <sly data-sly-use.clientLib="/libs/granite/sightly/templates/clientlib.html" data-sly-call="${clientLib.all @ categories='cq.jquery'}"/>

    But I think it didn't resolve the issue you are having.

    Translate
    akhilat9657589Author
    Level 2
    Feb 23, 2018 4:59 AM UTC

    Hi Kumar,

    We tried this, but still not working. As I have mentioned above, for some of the form submit, it is working, but in some it is not.

    Thanks,

    Akhila

    Translate
    pratekumar
    pratekumar
    Level 2
    Feb 23, 2018 4:46 AM UTC

    Hi Akhila

    Add cq.jquery as a dependency in your clientlib and see if it resolves the issue.

    Translate
      akhilat9657589AuthorAccepted solution
      Level 2
      Feb 23, 2018 3:10 AM UTC

      Yes, we are using Jquery Ajax to perform the operation. Now we have fixed the issue by adding the token to the form data using jquery.

      Translate
      smacdonald2008
      smacdonald2008
      Level 10
      Feb 21, 2018 6:05 PM UTC

      Are you using Adobe JQuery to perform the AJAX operation.

      Translate
      akhilat9657589Author
      Level 2
      Feb 21, 2018 11:55 AM UTC

      Note: Sorry, The configuration name I have mentioned is wrong. It is "Apache Granite CSRF Filter " instead of "Apache Sling Referrer Filter"

      Also the exception I am getting is as below.

      com.adobe.granite.csrf.impl.CSRFFilter isValidRequest: empty CSRF token - rejecting

      com.adobe.granite.csrf.impl.CSRFFilter doFilter: the provided CSRF token is invalid

      Apache Granite CSRF Filter

      Translate
      akhilat9657589Author
      Level 2
      Feb 21, 2018 11:49 AM UTC

      yes, it is working when POST is removed from CSRF filter. But we will not be able to do this as security fails.

      Thanks,

      Akhila

      Translate
      kautuk_sahni
      kautuk_sahni
      Employee
      Feb 21, 2018 11:23 AM UTC

      Check this this gets fixed after removing the 'POST' method for Filter Methods property in Apache Granite CSRF Filter configuration.

      Translate
      Kautuk Sahni
      Terms & ConditionsAccessibility statement

      Loading footer...