Disable CSRF on AEM 6.3 | Community
Skip to main content
mehmetsezgin
Level 2
Aug 20, 2019 11:46 AM UTC

Disable CSRF on AEM 6.3

Hi Community,

Our customer web site doesn't have any authenticated user. All users are anonymous.

Components have granite.jquery dependency so csrf protection is enabled automatically.

Dispatcher and publisher instance receiving too many unnecessary csrf token requests.

Is there any way to disable csrf protection on AEM 6.3?

Thanks in advance.

Mehmet

      This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

      10 replies

      himanshuj749478
      New Participant
      Sep 16, 2019 8:21 AM UTC

      Hi arunpatidar26​ JaideepBrar​

      How do I "remove the token call" for static publish environment? Like mentioned in the past - "excluding" it via filter is not same as removing the call.

      Thanks

      Himanshu

      Translate
        arunpatidar
        arunpatidar
        New Participant
        Sep 16, 2019 9:32 PM UTC

        You can write a redirect at apache server to return response of empty file when token.json is requested.

        e.g.

        RewriteEngine  on
        RewriteRule   "^/libs/granite/csrf/token\.json$"  "/emptyfile.json" [PT]

        Translate
        Arun Patidar
          Mayukh007
          Level 4
          Feb 12, 2021 12:14 AM UTC

          Hi Arun and Team,

          @arunpatidar 

          We have similar situation with token.json. our sites are mostly public and we dont need calls for token.json hit publisher. So we used your above solution to redirect call to a dummy json.

           

          but now we have CUG pages in the site and we were validating if we need to bring back token.json for CUG pages.

           

          Questions:

          1. Even if now token.json returns dummy value, AEM still works in CUG pages...Shouldn't AEM stop accessing CUG page when my token.json value is wrong and does not match value in publisher (I assume token.json value gets checked in server side for CSRF prevention)

           

          2. Can we completely get rid of token.json by removing Granite dependency for our CUG pages..? Does it really have any impact in terms of security..?

           

          3. Also we are seeing granite.js getting loaded in publisher which we should not need in publisher...Can we stop granite.js to be loaded in publisher but still use token.json..?

          Translate
            arunpatidar
            arunpatidar
            New Participant
            Aug 20, 2019 12:02 PM UTC

            Please check

            The CSRF Protection Framework

            you can add /content path in exclude filter at http://localhost:4504/system/console/configMgr/com.adobe.granite.csrf.impl.CSRFFilter

            Translate
            Arun Patidar
              mehmetsezginAuthor
              Level 2
              Aug 20, 2019 12:24 PM UTC

              Thanks Arun.

              Publisher responds with empty token to csrf requests. Since users are not authenticated.

              I think excluded path is used bypass csrf token check for certain destinations.

              https://taylor.callsen.me/security-and-java-servlets-in-aem-6-1/

              Our goal is stop browser's csrf token requests so dispatcher will not have to handle them.

              Translate
                user05162
                Employee
                Aug 20, 2019 2:09 PM UTC

                It is not a recommendation to remove the token.json call as this token.json call is used to prevent CSRF attacks and removing this would lead to a major security risk. Please refer to the documentation at [1].

                If you still want to remove the call, you need to remove all dependencies to "granite.jquery" in the code.

                [1] https://helpx.adobe.com/ca/experience-manager/6-3/sites/developing/using/csrf-protection.html

                [2] https://helpx.adobe.com/experience-manager/6-5/forms/using/admin-help/preventing-csrf-attacks.html

                [3] https://docs.adobe.com/content/help/en/experience-manager-dispatcher/using/configuring/configuring-dispatcher-to-prevent-csrf.html

                Translate
                  Terms & ConditionsAccessibility statement

                  Loading footer...