Sling Servlet 403 Forbidden Error

[saibul]

AEM 6.5.5

We have a form and we submit the form data to a servlet using post method. We have reactjs and webpack will pack js and added to clientlibs/clientlib-base.

Previously the form submission was working fine but recently it is not working. Even we are getting the same error when we try it from our publish server w ithout via dispatcher.

It works well if we remove POST from FilterMethods in Adobe Granite CSRF Filter config. But we cannot remove this in our prod publish.

In some of the threads they are asking to use cq.jquery but we cannot use cq.jquery in ui.frontend project.

Is there something we can pass additionally in the request header so that the server will honor the request.

It will be helpful if some has solution for it. 

[kchaurasiya]

@saibul Can you explain in the details what the operation you are doing with servlet. It will help to understand more on this. As you said form submission was working fine previously using post method and now it is not working.

Are you using the system user in servlet to reading/update any node properties?

Thank You.

Keshav Chaurasiya

[saibul]

@kchaurasiya thanks for your response.

No, just we collecting the values from form sending to a preconfigured email. We are not accessing any node data in the servlet.

[kchaurasiya · Accepted solution]

@saibul : Have you allowed proxy on the clientlib-base. Please check the below for the reference.

Thank You.

Keshav Chaurasiya

[Suraj_Kamdi]

@saibul 

Just include  dependency = "granite.csrf.standalone" property in clientlibrary folder. Adding this will allow POST calls.

Go through this article

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/csrf-protectio... 

https://experienceleague.adobe.com/docs/experience-manager-dispatcher/using/configuring/configuring-... 

[saibul]

@Suraj_Kamdi, Thanks for your response.. sorry it didnt help. I added granite.csrf.standalone value to both dependency as well as dependencies[] property, but no luck.