Expand my Community achievements bar.

Enhance your AEM Assets & Boost Your Development: [AEM Gems | June 19, 2024] Improving the Developer Experience with New APIs and Events
SOLVED

AEM CSRF Issues

Avatar

Level 1

We have a scenario where a servlet call is failing with 

'com.adobe.granite.csrf.impl.CSRFFilter isValidRequest: empty CSRF token - rejecting'

Some research into this lead us to this stack overflow post where it is indicated that including granite.csrf.standalone clientlib in your code will handle the CSRF headers. After including this we are still seeing the same CSRF error. Appending '?debugClientLibs=true' to our URL and searching for granite.csrf.standalone, we can see it loaded in correctly. Yet the CSRF is still not handled.

We have a workaround by manually grabbing /libs/granite/csrf/token.json, and submitting that in a 'CSRF-Token' header with the request. My question is how we can get the granite CSRF library to automatically handle this? Has anyone else had success with this method?

AEM version: 2021.11.6023.20211111T113531Z-211000


1 Accepted Solution

Avatar

Correct answer by
Community Advisor
3 Replies

Avatar

Correct answer by
Community Advisor

Avatar

Level 1

Hi Team,


These recommendations did not yield any results. For the time being, we are manually grabbing the token from /libs/granite/csrf/token.json and passing through CSRF-Token header. We may open a support case in the future to look into this.

Avatar

Level 1

Hi @rbranham  Are you able to solve the issue. 
I am getting the issue in aem author instance
Error Below :

06.12.2023 19:15:57.532 *INFO* [[0:0:0:0:0:0:0:1] [1701908157532] GET /libs/granite/csrf/token.json HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter isValidRequest: empty CSRF token - rejecting
06.12.2023 19:15:57.532 *INFO* [[0:0:0:0:0:0:0:1] [1701908157532] GET /libs/granite/csrf/token.json HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter doFilter: the provided CSRF token is invalid
06.12.2023 19:15:57.553 *INFO* [[0:0:0:0:0:0:0:1] [1701908157553] GET /favicon.ico HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter isValidRequest: empty CSRF token - rejecting
06.12.2023 19:15:57.553 *INFO* [[0:0:0:0:0:0:0:1] [1701908157553] GET /favicon.ico HTTP/1.1] com.adobe.granite.csrf.impl.CSRFFilter doFilter: the provided CSRF token is invalid

  Thanks,

J