Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

SOLVED

How to get CRSF Token value in AEM Publisher

kbitra1998
Level 3
Level 3

Hi,

we are calling an API using servlet, Our AEM Instance in 6.5.5, we are successfully able to call the servlet and send the CRSF Token in the author instance. However, In the Publisher instance, we are getting an empty response from the /libs/granite/csrf/token.json, how can we validate or authenticate the POST request to get the CRSF token value in AEM Publisher.

 

1 Accepted Solution
Asutosh_Jena_
Correct answer by
Community Advisor
Community Advisor

Hi @kbitra1998 

 

CSRF protection is only available for authenticated user. So in author it will be passed while making any servlet call as you will be logged in.

But on Publish instance, if you are making any anonymous call, CSRF token will be empty as there will not be any authentication.

"The basic idea: Server provides a CSRF token to the client for all authenticated sessions. The client should pass the same CSRF token to the server with each subsequent request. So if a request came without the token, the server should ignore/log it. Your CSRF token should ideally only be passed to the client upon authentication."

 

"There are no tokens on the publish instances for anonymous users."

 

Access http://localhost:4503/libs/granite/csrf/token.json while logged in as an user, you will get value.

Access http://localhost:4503/libs/granite/csrf/token.json as anonymous user, you will get empty {}.

 

Please refer the below link for more info:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protectio...

 

Thanks!

View solution in original post

0 Replies
Umesh_Thakur
Community Advisor
Community Advisor

@kbitra1998,

It seems like the permission issue for the anonymous user publish, So handle it you should be having one system user and provide the permission to the node.

It should work as expected.

https://experiencemanaged.com/posts/send-a-csrf-token-to-an-aem-61-servlet-without-using-jquery-or-g...

 

Hope this will help

Umesh Thakur 

Asutosh_Jena_
Correct answer by
Community Advisor
Community Advisor

Hi @kbitra1998 

 

CSRF protection is only available for authenticated user. So in author it will be passed while making any servlet call as you will be logged in.

But on Publish instance, if you are making any anonymous call, CSRF token will be empty as there will not be any authentication.

"The basic idea: Server provides a CSRF token to the client for all authenticated sessions. The client should pass the same CSRF token to the server with each subsequent request. So if a request came without the token, the server should ignore/log it. Your CSRF token should ideally only be passed to the client upon authentication."

 

"There are no tokens on the publish instances for anonymous users."

 

Access http://localhost:4503/libs/granite/csrf/token.json while logged in as an user, you will get value.

Access http://localhost:4503/libs/granite/csrf/token.json as anonymous user, you will get empty {}.

 

Please refer the below link for more info:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protectio...

 

Thanks!

kbitra1998
Level 3
Level 3

Thanks @Asutosh_Jena_ ,

Is there a way to get csrf token value for anonymous users on publish instance?

Like Whitelist the origin or site without authentication.

Asutosh_Jena_
Community Advisor
Community Advisor

Hi @kbitra1998 

CSRF token is not required for anonymous user. Why you need it on publish instance for anonymous user? What is the use case?

kbitra1998
Level 3
Level 3

Hi @Asutosh_Jena_ ,

 

The use case is to submit the POST request details to the API. In order to send securely, we have created a servlet '/bin/project_name/project_path' 

 CSRF Token in the author instance will be passed while making any servlet call as you will be logged in. 

I logged into Publish Instance with admin credentials and I successfully call the servlet and also get the CSRF token. However, using the domain, we do not authenticate the users, so we are making anonymous calls to the servlet. so it is getting a 301 status code.

so, is there a way to get a CSRF token value without authenticate?

Asutosh_Jena_
Community Advisor
Community Advisor

Hi @kbitra1998 

 

If you are getting 301 response, it will not be because of the CSRF token.

As you mentioned you are getting 301 only when you submit from the domain which I believe because of any redirect. To find the exact root cause, please submit the same request from publish directly without logging in as any user.

i.e. submit the same form from publish instance using anonymous user and see if you are able to submit.

If you are able to submit, the issue is with the dispatcher and there must be a 301 redirect in place which is causing the issue and you need to disable it.

If you are not able to submit, please look at the error log and request.log in publish instance and check what is the error you are noticing.

 

Also when you say you are getting 301 when you submit from website, do you see the request logged in request.log of publish instance?

kbitra1998
Level 3
Level 3

Thanks @Asutosh_Jena_ ,

The issue got resolved. From the dispatcher filter, we are rejecting the servlet path so we are getting 301 status code and redirects to 404 pages.