Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn more

View all

Sign in to view all badges

SOLVED

Can we remove POST filter from CSRF Filter and Sling Referrer Configuration

skadobe9
Level 1
Level 1

I created Custom Forms(not using AEM forms product) for my internal project, and it is working correctly external domain(www.example.com). Still, when the author tries to publish the form in the author instance, it throws a forbidden error in the console. After debugging the issue, when I remove the POST filter from Both the CSRF filter and Sling referrer configuration, it works well in the Author instance.

 

Question: in our OOTB configuration, we have a POST filter by default, so are there any cons for deleting the POST filter from these two configurations, or is there any other way I can solve this forbidden issue? Please let me know.

Sling referrer -

saiduluk8166139_0-1618247828206.png

CSRF filter

saiduluk8166139_1-1618247873894.png

 

AEM 6.5.6 Configuration
1 Accepted Solution
jbrar
Correct answer by
Employee
Employee

Instead of removing POST(Not safe), you can allow specific hosts that can make POST calls to AEM in the "Allowed Hosts" section. EX: If www.example.com is making a POST call to AEM which is failing, you can add "allowed host"= "www.example.com" and it should start working. Share the error.log if this is still failing

View solution in original post

3 Replies
jbrar
Correct answer by
Employee
Employee

Instead of removing POST(Not safe), you can allow specific hosts that can make POST calls to AEM in the "Allowed Hosts" section. EX: If www.example.com is making a POST call to AEM which is failing, you can add "allowed host"= "www.example.com" and it should start working. Share the error.log if this is still failing

View solution in original post

skadobe9
Level 1
Level 1

@jbrar Can we remove POST filter method from CSRF filter?

jbrar
Employee
Employee
Its not safe to remove POST from CSRF filter. I would recommend logging a support ticket to further debug the issue rather than removing the POST