How to get CRSF Token value in AEM Publisher

[kbitra1998]

Hi,

we are calling an API using servlet, Our AEM Instance in 6.5.5, we are successfully able to call the servlet and send the CRSF Token in the author instance. However, In the Publisher instance, we are getting an empty response from the /libs/granite/csrf/token.json, how can we validate or authenticate the POST request to get the CRSF token value in AEM Publisher.

[Umesh_Thakur]

@kbitra1998,

It seems like the permission issue for the anonymous user publish, So handle it you should be having one system user and provide the permission to the node.

It should work as expected.

https://experiencemanaged.com/posts/send-a-csrf-token-to-an-aem-61-servlet-without-using-jquery-or-g...

Hope this will help

Umesh Thakur 

[Asutosh_Jena_ · Accepted solution]

Hi @kbitra1998 

CSRF protection is only available for authenticated user. So in author it will be passed while making any servlet call as you will be logged in.

But on Publish instance, if you are making any anonymous call, CSRF token will be empty as there will not be any authentication.

"The basic idea: Server provides a CSRF token to the client for all authenticated sessions. The client should pass the same CSRF token to the server with each subsequent request. So if a request came without the token, the server should ignore/log it. Your CSRF token should ideally only be passed to the client upon authentication."

"There are no tokens on the publish instances for anonymous users."

Access http://localhost:4503/libs/granite/csrf/token.json while logged in as an user, you will get value.

Access http://localhost:4503/libs/granite/csrf/token.json as anonymous user, you will get empty {}.

Please refer the below link for more info:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protectio...

Thanks!

[kbitra1998]

Thanks @Asutosh_Jena_ ,

Is there a way to get csrf token value for anonymous users on publish instance?

Like Whitelist the origin or site without authentication.

[Asutosh_Jena_]

Hi @kbitra1998 

CSRF token is not required for anonymous user. Why you need it on publish instance for anonymous user? What is the use case?

[Parth-Sahu]

Hi @Asutosh_Jena_ ,

But this seems like a fair ask to have CSRF token for anonymous user (end user of the website) for the case where they submit a form (POST request most probably). This will avoid non-authenticated request for form submissions like maybe from any postman app by any hacker.

[kbitra1998]

Hi @Asutosh_Jena_ ,

The use case is to submit the POST request details to the API. In order to send securely, we have created a servlet '/bin/project_name/project_path' 

 CSRF Token in the author instance will be passed while making any servlet call as you will be logged in. 

I logged into Publish Instance with admin credentials and I successfully call the servlet and also get the CSRF token. However, using the domain, we do not authenticate the users, so we are making anonymous calls to the servlet. so it is getting a 301 status code.

so, is there a way to get a CSRF token value without authenticate?

[Asutosh_Jena_]

Hi @kbitra1998 

If you are getting 301 response, it will not be because of the CSRF token.

As you mentioned you are getting 301 only when you submit from the domain which I believe because of any redirect. To find the exact root cause, please submit the same request from publish directly without logging in as any user.

i.e. submit the same form from publish instance using anonymous user and see if you are able to submit.

If you are able to submit, the issue is with the dispatcher and there must be a 301 redirect in place which is causing the issue and you need to disable it.

If you are not able to submit, please look at the error log and request.log in publish instance and check what is the error you are noticing.

Also when you say you are getting 301 when you submit from website, do you see the request logged in request.log of publish instance?

[kbitra1998]

Thanks @Asutosh_Jena_ ,

The issue got resolved. From the dispatcher filter, we are rejecting the servlet path so we are getting 301 status code and redirects to 404 pages.

[rk_pandian]

Hi @kbitra1998 were you able to get CSRF token in the publish instance? because I have the same scenario now and not sure if I can use CSRF in publish or go with any other approach.

Update: http://localhost:4503/libs/granite/csrf/token.json doesn't create a token when logged out, so this cannot be used in Publish.

[Asutosh_Jena_]

Sounds good!