0

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's why CSRF guard throwing an exception: Token is missing in the request.

My question here is:

  1. CSRF Guard injects token into POST request or not? If YES then what I have to look for to make it work.
  2. Do I have to change my POST requests to make it work with CSRF guard? (Save the token into hidden fields and use it for POST requests.)

Please let me know your points if you know about it. Thanks.

1

Generally, you would indeed creating a hidden field in your forms for the CSRF token when you're POSTing.

From the documentation, it should look something like this:

<input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value/>"/>

Additionally, in order to work for post requests, the inject-into-forms property must be true, like you see in the example:

<init-param>
    <param-name>inject-into-forms</param-name>
    <param-value>true</param-value>
</init-param>

In fact, disabling this parameter is particularly discouraged, because of the sensitivity of many POST requests.

  • Thanks for your response, however No where mention in the document that it will work for POST requests. – Simpal Kumar Dec 20 '14 at 13:36
  • @Mike It actually does, though it's not terribly clear. I've added some specifics to my answer, and for more detail, search on inject-into-form in the documentation. – Xander Dec 20 '14 at 13:56
  • Ya. It's true in both the files web.xml and csrfguard.properties... – Simpal Kumar Dec 20 '14 at 14:23
  • I tried include it in jsp page and got this error No tag "token-name" defined in tag library imported with prefix "csrf" – Simpal Kumar Dec 20 '14 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.