How to get CRSF Token value in AEM Publisher

Question

Hi,we are calling an API using servlet, Our AEM Instance in 6.5.5, we are successfully able to call the servlet and send the CRSF Token in the author instance. However, In the Publisher instance, we are getting an empty response from the /libs/granite/csrf/token.json, how can we validate or authenticate the POST request to get the CRSF token value in AEM Publisher.

Asutosh_Jena_ · Accepted Answer

Hi @kbitra1998

CSRF protection is only available for authenticated user. So in author it will be passed while making any servlet call as you will be logged in.

But on Publish instance, if you are making any anonymous call, CSRF token will be empty as there will not be any authentication.

"The basic idea: Server provides a CSRF token to the client for all authenticated sessions. The client should pass the same CSRF token to the server with each subsequent request. So if a request came without the token, the server should ignore/log it. Your CSRF token should ideally only be passed to the client upon authentication."

"There are no tokens on the publish instances for anonymous users."

Access http://localhost:4503/libs/granite/csrf/token.json while logged in as an user, you will get value.

Access http://localhost:4503/libs/granite/csrf/token.json as anonymous user, you will get empty {}.

Please refer the below link for more info:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protection.html?lang=en

Thanks!

Umesh_Thakur · Answer

@kbitra1998,It seems like the permission issue for the anonymous user publish, So handle it you should be having one system user and provide the permission to the node.It should work as expected.https://experiencemanaged.com/posts/send-a-csrf-token-to-an-aem-61-servlet-without-using-jquery-or-granitecsrfstandalone-clientlib.html Hope this will helpUmesh Thakur

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded