Can we remove POST filter from CSRF Filter and Sling Referrer Configuration

[skadobe9]

I created Custom Forms(not using AEM forms product) for my internal project, and it is working correctly external domain(www.example.com). Still, when the author tries to publish the form in the author instance, it throws a forbidden error in the console. After debugging the issue, when I remove the POST filter from Both the CSRF filter and Sling referrer configuration, it works well in the Author instance.

Question: in our OOTB configuration, we have a POST filter by default, so are there any cons for deleting the POST filter from these two configurations, or is there any other way I can solve this forbidden issue? Please let me know.

Sling referrer -

CSRF filter

[Jaideep_Brar · Accepted solution]

Instead of removing POST(Not safe), you can allow specific hosts that can make POST calls to AEM in the "Allowed Hosts" section. EX: If www.example.com is making a POST call to AEM which is failing, you can add "allowed host"= "www.example.com" and it should start working. Share the error.log if this is still failing

[skadobe9]

@Jaideep_Brar Can we remove POST filter method from CSRF filter?

[Jaideep_Brar]

Its not safe to remove POST from CSRF filter. I would recommend logging a support ticket to further debug the issue rather than removing the POST