Level 2

Solved

Getting 404 for csrf token

6 replies
2200 views
Translate

Hi Team,

In dispatcher we are getting 404 for the csrf token. We are facing this issue only in the dispatcher level.

We have added below dispatcher configurations:

1) In clientheaders - "CSRF-Token" is added

2) In filters we have allowed the csrf token

/044 {
/selectors ''
/extension 'json'
/type "allow"
/method "GET"
/path '/libs/granite/csrf/token'
/suffix ''
}

3) We have added the below clientlib category -

granite.csrf.standalone

Please let me know if you've any possible solutions.

@Vijayalakshmi_S @arunpatidar @Suraj_Kamdi

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

V

Vanitha_DuraisamyAccepted solution

Level 2

Thanks for all the responses.

The issue got resolved after removing the below clientlibrary category from our code.

V

Vanitha_DuraisamyAuthorAccepted solution

Level 2

Thanks for all the responses.

The issue got resolved after removing the below clientlibrary category from our code.

Translate

rawvarun

New Participant

Add below caching rule to disallow caching for token path

{ /glob "/libs/granite/csrf/token.json" /type "deny" }

Translate

Himanshu_Jain

New Participant

Check Apache Sling Referrer Filter configuration

Ref: https://sourcedcode.com/blog/aem/in-aem-what-is-the-apache-sling-referrer-filter-osgi-configuration

Translate

Himanshu Jain

S

ShubhanshuSi2

New Participant

You may refer Configuring Dispatcher to Prevent CSRF Attacks | Adobe Experience Manager

Translate

AsifChowdhury

New Participant

Hello @vanitha_duraisamy

I have faced a similar type issue with the author

Then I had to fetch the CSRF token first then did the actual Ajax call.

let xhttp = new XMLHttpRequest();
            xhttp.open('GET', "/libs/granite/csrf/token.json", true);

            xhttp.onload = function() {
                if (xhttp.status === 200) {
                    let response = JSON.parse(xhttp.responseText);
                    let csrfToken = response.token;

                    let xhr = new XMLHttpRequest();
                    xhr.open("POST", url, true);
                    xhr.setRequestHeader('CSRF-Token', csrfToken);

                    xhr.onreadystatechange = function() {
                        if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
                        //     do rest of the things
                        }
                    };
                    xhr.send(JSON.stringify(data));
                }
            };

            xhttp.send();
        });

I am not sure but maybe you will get an idea from it.

Translate

V

Vanitha_DuraisamyAuthor

Level 2

Thanks @asifchowdhury

Our Ajax calls are working, we are getting this 404 error for csrf token in the page load for all the pages.

Also we are getting this error only in the dispatcher.

Translate

Sign up

Login with SSO

Login to the community

Login with SSO