Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn More

View all

Sign in to view all badges

How to get CRSF Token value in AEM Publisher

Avatar

Avatar
Level 1
kbitra1998
Level 1

Likes

0 likes

Total Posts

4 posts

Correct Reply

0 solutions
View profile

Avatar
Level 1
kbitra1998
Level 1

Likes

0 likes

Total Posts

4 posts

Correct Reply

0 solutions
View profile
kbitra1998
Level 1

25-05-2021

Hi,

we are calling an API using servlet, Our AEM Instance in 6.5.5, we are successfully able to call the servlet and send the CRSF Token in the author instance. However, In the Publisher instance, we are getting an empty response from the /libs/granite/csrf/token.json, how can we validate or authenticate the POST request to get the CRSF token value in AEM Publisher.

 

Accepted Solutions (1)

Accepted Solutions (1)

Avatar

Avatar
Give Back 100
Level 10
asutosh_jena
Level 10

Likes

551 likes

Total Posts

663 posts

Correct Reply

191 solutions
Top badges earned
Give Back 100
Boost 500
Affirm 100
Ignite 1
Establish
View profile

Avatar
Give Back 100
Level 10
asutosh_jena
Level 10

Likes

551 likes

Total Posts

663 posts

Correct Reply

191 solutions
Top badges earned
Give Back 100
Boost 500
Affirm 100
Ignite 1
Establish
View profile
asutosh_jena
Level 10

25-05-2021

Hi @kbitra1998 

 

CSRF protection is only available for authenticated user. So in author it will be passed while making any servlet call as you will be logged in.

But on Publish instance, if you are making any anonymous call, CSRF token will be empty as there will not be any authentication.

"The basic idea: Server provides a CSRF token to the client for all authenticated sessions. The client should pass the same CSRF token to the server with each subsequent request. So if a request came without the token, the server should ignore/log it. Your CSRF token should ideally only be passed to the client upon authentication."

 

"There are no tokens on the publish instances for anonymous users."

 

Access http://localhost:4503/libs/granite/csrf/token.json while logged in as an user, you will get value.

Access http://localhost:4503/libs/granite/csrf/token.json as anonymous user, you will get empty {}.

 

Please refer the below link for more info:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protectio...

 

Thanks!

kbitra1998

Thanks @asutosh_jena ,

Is there a way to get csrf token value for anonymous users on publish instance?

Like Whitelist the origin or site without authentication.

asutosh_jena

Hi @kbitra1998 

CSRF token is not required for anonymous user. Why you need it on publish instance for anonymous user? What is the use case?

kbitra1998

Hi @asutosh_jena ,

 

The use case is to submit the POST request details to the API. In order to send securely, we have created a servlet '/bin/project_name/project_path' 

 CSRF Token in the author instance will be passed while making any servlet call as you will be logged in. 

I logged into Publish Instance with admin credentials and I successfully call the servlet and also get the CSRF token. However, using the domain, we do not authenticate the users, so we are making anonymous calls to the servlet. so it is getting a 301 status code.

so, is there a way to get a CSRF token value without authenticate?

asutosh_jena

Hi @kbitra1998 

 

If you are getting 301 response, it will not be because of the CSRF token.

As you mentioned you are getting 301 only when you submit from the domain which I believe because of any redirect. To find the exact root cause, please submit the same request from publish directly without logging in as any user.

i.e. submit the same form from publish instance using anonymous user and see if you are able to submit.

If you are able to submit, the issue is with the dispatcher and there must be a 301 redirect in place which is causing the issue and you need to disable it.

If you are not able to submit, please look at the error log and request.log in publish instance and check what is the error you are noticing.

 

Also when you say you are getting 301 when you submit from website, do you see the request logged in request.log of publish instance?

kbitra1998

Thanks @asutosh_jena ,

The issue got resolved. From the dispatcher filter, we are rejecting the servlet path so we are getting 301 status code and redirects to 404 pages.

asutosh_jena
Sounds good!

Answers (1)

Answers (1)

Avatar

Avatar
Validate 1
MVP
Umesh_Thakur
MVP

Likes

147 likes

Total Posts

157 posts

Correct Reply

53 solutions
Top badges earned
Validate 1
Applaud 25
Ignite 3
Ignite 1
Give Back 5
View profile

Avatar
Validate 1
MVP
Umesh_Thakur
MVP

Likes

147 likes

Total Posts

157 posts

Correct Reply

53 solutions
Top badges earned
Validate 1
Applaud 25
Ignite 3
Ignite 1
Give Back 5
View profile
Umesh_Thakur
MVP

25-05-2021

@kbitra1998,

It seems like the permission issue for the anonymous user publish, So handle it you should be having one system user and provide the permission to the node.

It should work as expected.

https://experiencemanaged.com/posts/send-a-csrf-token-to-an-aem-61-servlet-without-using-jquery-or-g...

 

Hope this will help

Umesh Thakur