Expand my Community achievements bar.

SOLVED

Can we remove POST filter from CSRF Filter and Sling Referrer Configuration

Avatar

Level 1

I created Custom Forms(not using AEM forms product) for my internal project, and it is working correctly external domain(www.example.com). Still, when the author tries to publish the form in the author instance, it throws a forbidden error in the console. After debugging the issue, when I remove the POST filter from Both the CSRF filter and Sling referrer configuration, it works well in the Author instance.

 

Question: in our OOTB configuration, we have a POST filter by default, so are there any cons for deleting the POST filter from these two configurations, or is there any other way I can solve this forbidden issue? Please let me know.

Sling referrer -

saiduluk8166139_0-1618247828206.png

CSRF filter

saiduluk8166139_1-1618247873894.png

 

Topics

Topics help categorize Community content and increase your ability to discover relevant content.

6.5
1 Accepted Solution

Avatar

Correct answer by
Employee Advisor

Instead of removing POST(Not safe), you can allow specific hosts that can make POST calls to AEM in the "Allowed Hosts" section. EX: If www.example.com is making a POST call to AEM which is failing, you can add "allowed host"= "www.example.com" and it should start working. Share the error.log if this is still failing

View solution in original post

3 Replies

Avatar

Correct answer by
Employee Advisor

Instead of removing POST(Not safe), you can allow specific hosts that can make POST calls to AEM in the "Allowed Hosts" section. EX: If www.example.com is making a POST call to AEM which is failing, you can add "allowed host"= "www.example.com" and it should start working. Share the error.log if this is still failing

Avatar

Employee Advisor
Its not safe to remove POST from CSRF filter. I would recommend logging a support ticket to further debug the issue rather than removing the POST